CERT-MU :Advisories

Home | Search | FAQ | Site Map | Contact Us

|| Hotline : 800 2378 || To contact CERT-MU send e-mail on --> info[at]cert-mu.gov.mu || To report incident e-mail on --> incident[at]cert-mu.gov.mu || To report Vulnerabilities send e-mail on --> Vulnerability[at]cert-mu.gov.mu ||

Charter & Mission

CERT-MU Services

Constituency

Authority

Incident Reporting

Vulnerability Reporting

Incident Statistics Forms

Vol. 2, Feb 2012

Vol. 1, Oct 2011

World CERTs

Security Sites

Security Tools

Antivirus Resources

Email Abuse

Network Abuse

Anti-Spam Initiative

Cyber Security Portal

Safer Internet Day

Computer Security Day

National Computer Board

Authorized to use CERT(TM) - CERT is a mark owned by Carnegie Mellon University

CERT-MU AD-2009-14

Multiple Vulnerabilities in Opera

Original issue date: 07 September, 2009

Overview

Multiple vulnerabilities have been reported in Opera, which could be exploited to bypass security restrictions and conduct spoofing attacks.

Description

Intermediate Certificate Spoofing Vulnerability

This vulnerability exists because Opera fails to check the revocation status for intermediate certificates not served by the server. This may cause sites using revoked intermediate certificates to be shown as secure.

URL Spoofing Vulnerability

This vulnerability is caused by improper updation of domain name within the collapsed address bar, which could cause the previous domain to be shown instead of the domain of the present site.This could be exploited by remote attackers to spoof URLs.

Limited Address Spoofing Vulnerability

This vulnerability is due to certain Unicode characters are treated incorrectly, which might cause International Domain Names (IDN) that use them to be shown in the wrong format. Attackers could exploit this vulnerability to perform limited address spoofing.

Security Bypass Vulnerability

This vulnerability exists because the browser fails to properly validate the domain name in a signed CA certificate. A remote attacker could exploit this vulnerability by using a certificate which use a wild card immediately before the top level domain, or nulls in the domain name, to be incorrectly interpreted as secure.