Nessus Plugin #14261

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Opera remote location object cross-domain scripting vulnerability

Family:

Windows

Category:

infos

Copyright:

This script is Copyright (C) 2004 David Maciejak

Summary:

Determines the version of Opera.exe

Version:

$Revision: 1.4 $

Cve_id:

-

Bugtraq_id:

10873

Xrefs:

OSVDB:8331

Description:

The remote host is using Opera - an alternative web browser.

This version contains a flaw that allows a remote
cross site scripting attack.

This flaw exists because Opera fails to block write access to the 'location' object.
This could allow a user to create a specially crafted URL to overwrite
methods within the 'location' object that would execute arbitrary code
in a user's browser within the trust relationship between the browser and the server,
leading to a loss of integrity.

Solution : Install Opera 7.54 or newer.
Risk factor : High