Secunia Research: Opera Mail Client Attachment Spoofing and Script Insertion

[Secunia Research <vuln () secunia com>]

====================================================================== 

                     Secunia Research 20/09/2005

   - Opera Mail Client Attachment Spoofing and Script Insertion -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

====================================================================== 
1) Affected Software 

Opera 8.02

Prior versions may also be affected.

====================================================================== 
2) Severity 

Rating: Moderately Critical
Impact: Script Insertion, Spoofing
Where:  From Remote

====================================================================== 
3) Description of Vulnerability

Secunia Research has discovered two vulnerabilities in the Opera Mail
client, which can be exploited by a malicious person to conduct script
insertion attacks and to spoof the name of attached files.

1. Attached files are opened without any warnings directly from the
user's cache directory. This can be exploited to execute arbitrary 
JavaScript in context of "file://".

2. Normally, filename extensions are determined by the "Content-Type"
in Opera Mail. However, by appending an additional '.' to the end of
a filename, an HTML file could be spoofed to be e.g. "image.jpg.". 

The two vulnerabilities combined may be exploited to conduct script
insertion attacks if the user chooses to view an attachment named
e.g. "image.jpg." e.g. resulting in disclosure of local files.

====================================================================== 
4) Solution 

Update to version 8.50.
http://www.opera.com/download/

====================================================================== 
5) Time Table 

01/09/2005 - Initial vendor notification.
20/09/2005 - Public disclosure.

====================================================================== 
6) Credits 

Discovered by Jakob Balle, Secunia Research.

====================================================================== 
7) References

No references available.

====================================================================== 
8) About Secunia 

Secunia collects, validates, assesses, and writes advisories regarding 
all the latest software vulnerabilities disclosed to the public. These 
advisories are gathered in a publicly available database at the 
Secunia website: 

http://secunia.com/

Secunia offers services to our customers enabling them to receive all 
relevant vulnerability information to their specific system 
configuration. 

Secunia offers a FREE mailing list called Secunia Security Advisories: 

http://secunia.com/secunia_security_advisories/

====================================================================== 
9) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-42/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/