Title: Opera Browser Favicon Address Bar Spoofing Weakness
Severity: MODERATE
Description:
Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information.
This issue presents itself when an attacker uses a malicious 'Shortcut Icon' or 'favicon' to obfuscate information displayed in the address bar. The 'favicon' feature is a multi-resolution image that allows Web sites to add a small icon to the address bar and/or favorites in a browser.
It is reported that the 'favicon' feature can be used to spoof the domain of a malicious web page, potentially causing the victim user to trust the spoofed domain. An attacker can create an icon that includes the text of the desired site and is similar to the way Opera displays information in the address bar. This results in Opera displaying this image and the address to the right of the image. The real address to the attacker's site can then be obfuscated by spaces.
If the user trusts the malicious web page, they may take further actions that can potentially compromise sensitive information.
This issue can be used to spoof information in the address bar, page bar and page/window cycler.
The vulnerability reportedly affects Opera 7.23 and 7.50. It is likely that previous versions are affected as well.
Affected Products:
- Opera Software Opera Web Browser 7.23.0
- Opera Software Opera Web Browser 7.50.0
References:
- Opera Software: Opera 7.51 for Windows Changelog
- Opera Software: Opera Web Browser Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
