search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Opera may insecurely execute binary data encoded in a URI

Vulnerability Note VU#882926

Original Release Date: 2005-01-21 | Last Revised: 2005-02-03

Overview

The Opera web browser fails to validate data encoded using the RFC 2397 scheme. A remote attacker may be able to execute arbitrary code on a vulnerable system.

Description

The Opera web browser fails to properly handle binary data encoded following the RFC 2397 specification for sending data in a URI. According to RFC 2397, binary data can be encoded directly in a URI in the following format:

data:[<mediatype>][;base64],<data>

    Where data is base64 encoded binary data.

    If binary data is encoded in a URI following the RFC 2397 scheme, and accessed via an Opera web browser, Opera will prompt the user for the action to take (OPEN, SAVE, or CANCEL). If the user attempts to open the binary data with Opera, the data should open with an application the user chooses or the default application if one isn't specified. However, Opera executes the binary data directly (if the binary data is executable).

    In addition, security software such as anti-virus and content scanning applications, may not detect malicious content encoded with the RFC 2397 scheme. Consequently, the scanning software may allow the malicious content into the system.

    Impact

    If a remote attacker can convince a user to access a specially crafted web page or HTML email, that attacker may be able to run an arbitrary code on the users system.

    Solution

    We are not aware a practical solution at this time. Consider the following Workaround:

    Do Not Follow Unsolicited Links

    In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases.

    Vendor Information

    882926
     
    Affected   Unknown   Unaffected

    Opera Software

    Updated:  January 20, 2005

    Status

      Unknown

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    The vendor has not provided us with any further information regarding this vulnerability.

    Addendum

    US-CERT has no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.


    CVSS Metrics

    Group Score Vector
    Base N/A N/A
    Temporal N/A N/A
    Environmental N/A

    References

    Acknowledgements

    This vulnerability was reported by Michael Holzt.

    This document was written by Jeff Gennari.

    Other Information

    CVE IDs: None
    Severity Metric: 12.24
    Date Public: 2005-01-11
    Date First Published: 2005-01-21
    Date Last Updated: 2005-02-03 15:03 UTC
    Document Revision: 168

    Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.