[security-alerts] FW: [SA26074] Opera "data:" URI Scheme Address Bar Spoofing Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

>
> TITLE:
> Opera "data:" URI Scheme Address Bar Spoofing Vulnerability
>
> SECUNIA ADVISORY ID:
> SA26074
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/26074/
>
> CRITICAL:
> Less critical
>
> IMPACT:
> Spoofing
>
> WHERE:
> From remote
>
> SOFTWARE:
> Opera 9.x
> http://secunia.com/product/10615/
>
> DESCRIPTION:
> Robert Swiecki has discovered a vulnerability in Opera, which can be
> exploited by malicious people to conduct spoofing attacks.
>
> The vulnerability is caused due to an error in the handling of the
> "data:" URI scheme. This can be exploited to display arbitrary
> content while showing the URL of a trusted web site in the address
> bar when a user follows a specially crafted link.
>
> The vulnerability is confirmed in version 9.21. Other versions may
> also be affected.
>
> SOLUTION:
> Do not follow links from untrusted web sites.
>
> PROVIDED AND/OR DISCOVERED BY:
> Robert Swiecki
>
> ORIGINAL ADVISORY:
> http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/0
> 64638.html
>