Title: Opera Browser URI Display Obfuscation Weakness
Severity: MODERATE
Description:
A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a supplied username, contains a specially crafted sequence of characters such as "\xC0\x80", "\xC0\xBF", "\xC1\x80", and "\xC1\xBF" etc. These characters will be interpreted as a NULL due to UTF-8 encoding. This sequence may be placed as part of the username value prior to the @ symbol in the malicious URI to aid in obfuscating the URI for a visited page.
Specifically, the malicious URI must be formatted as follows, where %C0 may be any non-displayable hexadecimal value:
http://www.malicious.com%C0%80@www.trusted.com/
Upon clicking the link, the URI field would contain www.trusted.com despite the access site actually being www.malicious.com. It should be noted that manually placing such a URI into the location may not work, as the hexadecimal value must not be escaped.
An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site. If an unsuspecting victim were to follow the link and attempt to verify the authenticity of the current location by checking the current URI, they may be deceived into believing they are at the actual trusted site. This could potentially cause a false sense of security for the victim. It has been reported that the browser will display a warning before a page is displayed in HTTP and HTTPS, however no warning dialog is displayed for FTP.
This issue is reported to affect Opera 6.06 with "Encoding all addresses with UTF-8" enabled, however other versions could be affected as well.
Affected Products:
- Opera Software Opera Web Browser 6.0.0 6
References:
- Opera Software: Opera Web Browser Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
