| Description: | Summary:
The remote host is missing an update to the system
as announced in the referenced advisory.
Vulnerability Insight:
The following packages are affected:
opera
linux-opera
opera-devel
CVE-2011-3389
The SSL protocol, as used in certain configurations in Microsoft
Windows and Microsoft Internet Explorer, Mozilla Firefox, Google
Chrome, Opera, and other products, encrypts data by using CBC mode
with chained initialization vectors, which allows man-in-the-middle
attackers to obtain plaintext HTTP headers via a blockwise
chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with
JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java
URLConnection API, or (3) the Silverlight WebClient API, aka a 'BEAST'
attack.
CVE-2011-4681
Opera before 11.60 does not properly consider the number of . (dot)
characters that conventionally exist in domain names of different
top-level domains, which allows remote attackers to bypass the Same
Origin Policy by leveraging access to a different domain name in the
same top-level domain, as demonstrated by the .no or .uk domain.
CVE-2011-4682
The JavaScript engine in Opera before 11.60 does not properly
implement the in operator, which allows remote attackers to bypass the
Same Origin Policy via vectors related to variables on different web
sites.
CVE-2011-4683
Unspecified vulnerability in Opera before 11.60 has unknown impact and
attack vectors, related to a 'moderately severe issue.'
Solution:
Update your system with the appropriate patches or
software upgrades.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
