Bug 244980 – www-client/opera < 9.62: Multiple vulnerabilities (RCE through history XSS) (CVE-2008-{4794,4795})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Jeroen Roovers (RETIRED) 2008-10-30 17:11:14 UTC]

Ebuild coming soon to a tree near you.

[Comment 1 Jeroen Roovers (RETIRED) 2008-10-30 18:19:29 UTC]

The ebuild is in the tree.

* Fixed an issue where History Search could be used to execute arbitrary code, as discovered by Aviv Raff; see our advisory[1]
* The links panel no longer allows cross-site scripting; see our advisory[2]

[1] http://www.opera.com/support/search/view/906/ "Extremely Severe"
[2] http://www.opera.com/support/search/view/907/ "Highly Severe"

[Comment 2 Christian Hoffmann (RETIRED) 2008-10-30 18:25:42 UTC]

Thanks, setting whiteboard and severity, CC'ing arches...

Arches, please test and stabilize:
  =www-client/opera-9.62
Target keywords: "amd64 ppc x86"

[Comment 3 Tobias Scherbaum (RETIRED) 2008-10-30 19:01:14 UTC]

ppc stable

[Comment 4 Christian Hoffmann (RETIRED) 2008-10-30 19:19:53 UTC]

We should note in our GLSA, that users may remain vulnerable even after upgrading, once the config has been manipulated by a malicious script (i.e. mailto handler for example).

[Comment 5 Stefan Behte (RETIRED) 2008-10-30 20:38:36 UTC]

We could create a script that checks for manipulation and warns the user...?

[Comment 6 Ilmari Hytönen 2008-10-30 21:03:36 UTC]

Comment written with opera 9.62 x86.

Seems to work just like older version.

[Comment 7 Robert Buchholz (RETIRED) 2008-10-30 21:24:06 UTC]

(In reply to comment #5)
> We could create a script that checks for manipulation and warns the user...?

I don't think we want to go so far, people need to do forensics on their systems if someone exploited a security issue anyway. There are tons of cases where we cannot determine an exploit scenario via a script.

[Comment 8 Jeroen Roovers (RETIRED) 2008-10-30 21:30:40 UTC]

# ChangeLog for www-client/opera
# Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
# $Header: /var/cvsroot/gentoo-x86/www-client/opera/ChangeLog,v 1.303 2008/10/30 21:17:39 keytoaster Exp $

  30 Oct 2008; Tobias Heinlein <[e-mail]> opera-9.62.ebuild:
  amd64 stable, security bug #244980

[Comment 9 Tobias Heinlein (RETIRED) 2008-10-30 22:20:16 UTC]

(In reply to comment #8)
> # ChangeLog for www-client/opera
> # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
> # $Header: /var/cvsroot/gentoo-x86/www-client/opera/ChangeLog,v 1.303
> 2008/10/30 21:17:39 keytoaster Exp $
> 
>   30 Oct 2008; Tobias Heinlein <[e-mail]> opera-9.62.ebuild:
>   amd64 stable, security bug #244980
> 

Oops, forgot to report on the bug. Thanks!

[Comment 10 Stefan Behte (RETIRED) 2008-10-31 11:46:17 UTC]

CVE-2008-4794 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4794):
  Opera before 9.62 allows remote attackers to execute arbitrary
  commands via the History Search results page, a different
  vulnerability than CVE-2008-4696.

CVE-2008-4795 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4795):
  The links panel in Opera before 9.62 processes Javascript within the
  context of the "outermost page" of a frame, which allows remote
  attackers to inject arbitrary web script or HTML via cross-site
  scripting (XSS) attacks.

[Comment 11 Jeroen Roovers (RETIRED) 2008-11-01 18:09:44 UTC]

@x86: ping

[Comment 12 Markus Meier 2008-11-01 23:51:36 UTC]

pong, all arches done.

[Comment 13 Tobias Heinlein (RETIRED) 2008-11-03 19:02:02 UTC]

GLSA 200811-01, thanks everyone.