J-Security Center

Latest Attack Object Updates
  • IDP Daily Update #1601
    posted: 02/08/10
  • NSM Daily Update #1601
    posted: 02/08/10
  • Deep Inspection 5.3r5 and above, 5.4, 6.0 #1601
    posted: 02/08/10
  • Deep Inspection 5.1 and 5.2 #1435
    posted: 02/08/10
  • Deep Inspection 5.0, 5.3r4 and below #1132
    posted: 03/28/08 (04/01/08 for 5.0)
  • Antivirus
    posted: 02/07/10

Title: Opera Browser Favicon Address Bar Spoofing Weakness

Severity: MODERATE

Description:

Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information.

This issue presents itself when an attacker uses a malicious 'Shortcut Icon' or 'favicon' to obfuscate information displayed in the address bar. The 'favicon' feature is a multi-resolution image that allows Web sites to add a small icon to the address bar and/or favorites in a browser.

It is reported that the 'favicon' feature can be used to spoof the domain of a malicious web page, potentially causing the victim user to trust the spoofed domain. An attacker can create an icon that includes the text of the desired site and is similar to the way Opera displays information in the address bar. This results in Opera displaying this image and the address to the right of the image. The real address to the attacker's site can then be obfuscated by spaces.

If the user trusts the malicious web page, they may take further actions that can potentially compromise sensitive information.

This issue can be used to spoof information in the address bar, page bar and page/window cycler.

The vulnerability reportedly affects Opera 7.23 and 7.50. It is likely that previous versions are affected as well.

Affected Products:

  • Opera Software Opera Web Browser 7.23.0
  • Opera Software Opera Web Browser 7.50.0

References:

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.