Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 244980 (CVE-2008-4794) - www-client/opera < 9.62: Multiple vulnerabilities (RCE through history XSS) (CVE-2008-{4794,4795})
Summary: www-client/opera < 9.62: Multiple vulnerabilities (RCE through history XSS) (...
Status: RESOLVED FIXED
Alias: CVE-2008-4794
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://www.opera.com/docs/changelogs/...
Whiteboard: A2 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2008-10-30 17:11 UTC by Jeroen Roovers
Modified: 2008-11-03 19:02 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jeroen Roovers gentoo-dev 2008-10-30 17:11:14 UTC
Ebuild coming soon to a tree near you.
Comment 1 Jeroen Roovers gentoo-dev 2008-10-30 18:19:29 UTC
The ebuild is in the tree.

* Fixed an issue where History Search could be used to execute arbitrary code, as discovered by Aviv Raff; see our advisory[1]
* The links panel no longer allows cross-site scripting; see our advisory[2]

[1] http://www.opera.com/support/search/view/906/ "Extremely Severe"
[2] http://www.opera.com/support/search/view/907/ "Highly Severe"
Comment 2 Christian Hoffmann (RETIRED) gentoo-dev 2008-10-30 18:25:42 UTC
Thanks, setting whiteboard and severity, CC'ing arches...

Arches, please test and stabilize:
  =www-client/opera-9.62
Target keywords: "amd64 ppc x86"
Comment 3 Tobias Scherbaum (RETIRED) gentoo-dev 2008-10-30 19:01:14 UTC
ppc stable
Comment 4 Christian Hoffmann (RETIRED) gentoo-dev 2008-10-30 19:19:53 UTC
We should note in our GLSA, that users may remain vulnerable even after upgrading, once the config has been manipulated by a malicious script (i.e. mailto handler for example).
Comment 5 Stefan Behte (RETIRED) gentoo-dev Security 2008-10-30 20:38:36 UTC
We could create a script that checks for manipulation and warns the user...?
Comment 6 Ilmari Hytönen 2008-10-30 21:03:36 UTC
Comment written with opera 9.62 x86.

Seems to work just like older version.
Comment 7 Robert Buchholz (RETIRED) gentoo-dev 2008-10-30 21:24:06 UTC
(In reply to comment #5)
> We could create a script that checks for manipulation and warns the user...?

I don't think we want to go so far, people need to do forensics on their systems if someone exploited a security issue anyway. There are tons of cases where we cannot determine an exploit scenario via a script.
Comment 8 Jeroen Roovers gentoo-dev 2008-10-30 21:30:40 UTC
# ChangeLog for www-client/opera
# Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
# $Header: /var/cvsroot/gentoo-x86/www-client/opera/ChangeLog,v 1.303 2008/10/30 21:17:39 keytoaster Exp $

  30 Oct 2008; Tobias Heinlein <keytoaster@gentoo.org> opera-9.62.ebuild:
  amd64 stable, security bug #244980
Comment 9 Tobias Heinlein (RETIRED) gentoo-dev 2008-10-30 22:20:16 UTC
(In reply to comment #8)
> # ChangeLog for www-client/opera
> # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
> # $Header: /var/cvsroot/gentoo-x86/www-client/opera/ChangeLog,v 1.303
> 2008/10/30 21:17:39 keytoaster Exp $
> 
>   30 Oct 2008; Tobias Heinlein <keytoaster@gentoo.org> opera-9.62.ebuild:
>   amd64 stable, security bug #244980
> 

Oops, forgot to report on the bug. Thanks!
Comment 10 Stefan Behte (RETIRED) gentoo-dev Security 2008-10-31 11:46:17 UTC
CVE-2008-4794 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4794):
  Opera before 9.62 allows remote attackers to execute arbitrary
  commands via the History Search results page, a different
  vulnerability than CVE-2008-4696.

CVE-2008-4795 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4795):
  The links panel in Opera before 9.62 processes Javascript within the
  context of the "outermost page" of a frame, which allows remote
  attackers to inject arbitrary web script or HTML via cross-site
  scripting (XSS) attacks.

Comment 11 Jeroen Roovers gentoo-dev 2008-11-01 18:09:44 UTC
@x86: ping
Comment 12 Markus Meier gentoo-dev 2008-11-01 23:51:36 UTC
pong, all arches done.
Comment 13 Tobias Heinlein (RETIRED) gentoo-dev 2008-11-03 19:02:02 UTC
GLSA 200811-01, thanks everyone.