Vulnerability Name:

CVE-2005-2407 (CCN-23693)

Assigned:2005-08-01
Published:2005-08-01
Updated:2022-02-28
Summary:A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download dialog box, then tricking the user into double-clicking on the "Run" button, aka "link hijacking".
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-1021
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2005-2407

Source: CCN
Type: SA15781
Opera Suppressed "Download Dialog" File Execution Vulnerability

Source: SECUNIA
Type: Broken Link, Patch, Vendor Advisory
15781

Source: MISC
Type: Broken Link
http://secunia.com/secunia_research/2005-19/advisory/

Source: CCN
Type: SECTRACK ID: 1015353
Opera Browser May Let Remote Users Obfuscate the Download Dialog Box

Source: SECTRACK
Type: Broken Link, Third Party Advisory, VDB Entry
1015353

Source: CCN
Type: Opera Web site
Opera 8.02 for Linux Changelog

Source: CONFIRM
Type: Broken Link, Patch
http://www.opera.com/linux/changelogs/802/

Source: CCN
Type: OSVDB ID: 19129
Opera Unspecified Link Hijacking

Source: CCN
Type: OSVDB ID: 21765
Opera Suppressed Download Dialog File Execution

Source: CCN
Type: OSVDB ID: 31654
Opera File Download Race Condition Action Weakness

Source: CCN
Type: OSVDB ID: 67204
Opera Tab Focus Change Download Dialog Suppression Weakness Clickjacking

Source: BID
Type: Broken Link, Third Party Advisory, VDB Entry
15835

Source: CCN
Type: BID-15835
Opera Web Browser Download Dialog Manipulation File Execution Vulnerability

Source: VUPEN
Type: Broken Link
ADV-2005-1251

Source: XF
Type: UNKNOWN
opera-dialog-box-execute-code(23693)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:opera:opera_browser:*:*:*:*:*:*:*:* (Version <= 8.01)

    • Configuration CCN 1:
  • cpe:/a:opera:opera_browser:8.01:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    opera opera browser *
    opera opera browser 8.01