Overview
The Opera web browser fails to validate data encoded using the RFC 2397 scheme. A remote attacker may be able to execute arbitrary code on a vulnerable system.
Description
The Opera web browser fails to properly handle binary data encoded following the RFC 2397 specification for sending data in a URI. According to RFC 2397, binary data can be encoded directly in a URI in the following format: data:[<mediatype>][;base64],<data> If binary data is encoded in a URI following the RFC 2397 scheme, and accessed via an Opera web browser, Opera will prompt the user for the action to take (OPEN, SAVE, or CANCEL). If the user attempts to open the binary data with Opera, the data should open with an application the user chooses or the default application if one isn't specified. However, Opera executes the binary data directly (if the binary data is executable). In addition, security software such as anti-virus and content scanning applications, may not detect malicious content encoded with the RFC 2397 scheme. Consequently, the scanning software may allow the malicious content into the system. |
Impact
If a remote attacker can convince a user to access a specially crafted web page or HTML email, that attacker may be able to run an arbitrary code on the users system. |
Solution
We are not aware a practical solution at this time. Consider the following Workaround: |
Do Not Follow Unsolicited Links |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported by Michael Holzt.
This document was written by Jeff Gennari.
Other Information
| CVE IDs: | CVE-2005-0456 |
| Severity Metric: | 12.24 |
| Date Public: | 2005-01-11 |
| Date First Published: | 2005-01-20 |
| Date Last Updated: | 2005-02-03 15:03 UTC |
| Document Revision: | 169 |