Title: Opera Web Browser Address Bar Spoofing Weakness
Severity: MODERATE
Description:
Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information.
This is reportedly possible through malicious use of the JavaScript "unOnload" event handler when the browser is redirected to another page. Although specific details have not been provided, this reportedly bypasses a feature in Opera where the address bar also changes when the client is directed to another web page. It has been reported that the exploit entails inserting an inline "unOnload" event handler in the HTML <BODY> tag.
This issue could be exploited to spoof the domain of a malicious web page, potentially causing the victim user to trust the spoofed domain. If the user trusts the malicious web page, they may take further actions that can potentially compromise sensitive information.
The vulnerability reportedly affects Opera 7.23 releases on Windows and Linux platforms. Earlier versions may also be affected.
Affected Products:
- Opera Software Opera Web Browser 7.23.0
References:
- Opera Software: Opera Web Browser Home Page
- Secunia: Opera Browser Address Bar Spoofing
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
