OSVDB ID: 21003

Title: Opera Command Line URL Shell Command Injection

Info

Disclosure
Nov 22, 2005

Discovery
Sep 22, 2005

Dates

Exploit
Unknown

Solution
Unknown

Description

 Opera contains a flaw that may allow an attacker to execute arbitrary shell commands on a users client. The issue is triggered due to the improper handling of the command line interface allowing the injection of backtick ("`") shell commands into the URL parameter, and resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

 Upgrade to version 8.51 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Opera Software ASA

Opera

 8.5
8.02
8.01
8.00

References

Credit
  • Jakob Balle - jbsecunia.com - Secunia Research


Direct URL: http://osvdb.org/21003