Vulnerability Name:

CVE-2010-2657 (CCN-60291)

Assigned:2010-06-30
Published:2010-06-30
Updated:2021-09-08
Summary:Opera before 10.60 on Windows and Mac OS X does not properly prevent certain double-click operations from running a program located on a web site, which allows user-assisted remote attackers to execute arbitrary code via a crafted web page that bypasses a dialog.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-264
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-2657

Source: CCN
Type: SA40375
Opera Two Security Issues

Source: SECUNIA
Type: Third Party Advisory
40375

Source: CONFIRM
Type: Vendor Advisory
http://www.opera.com/docs/changelogs/mac/1060/

Source: CONFIRM
Type: Vendor Advisory
http://www.opera.com/docs/changelogs/windows/1060/

Source: CCN
Type: Opera Software Web Site
Users can be tricked into uploading unexpected files

Source: CONFIRM
Type: Vendor Advisory
http://www.opera.com/support/search/view/957/

Source: CCN
Type: OSVDB ID: 66224
Opera Download Dialog Double-Click Action Arbitrary Code Execution

Source: VUPEN
Type: Permissions Required, Third Party Advisory
ADV-2010-1664

Source: XF
Type: UNKNOWN
opera-dialog-code-execution(60291)

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:11856

Vulnerable Configuration:Configuration 1:
  • cpe:/a:opera:opera_browser:*:*:*:*:*:*:*:* (Version < 10.60)
  • AND
  • cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*
  • OR cpe:/o:apple:macos:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:opera:opera_browser:5.11:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.03:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.04:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.05:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.01:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.02:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.06:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.11:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.20:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.51:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.52:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.24:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.23:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.25:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.26:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.27:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.50:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.50:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.50:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.50:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.20:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.50:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.22:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.21:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.20:beta7:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.10:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.03:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.02:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.01:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.10:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.12:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.60:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.61:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.62:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.60:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.63:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.10:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.21:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.54:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.53:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.54:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.23:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.01:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.60:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.51:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.53:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.02:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.50:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.01:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.52:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.20:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.12:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.02:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.22:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:beta5:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:beta6:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:beta7:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.0:beta8:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:5.02:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.52:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.51:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:9.64:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.00:beta3:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.01:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.00:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.10:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.50:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.52:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.53:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.53:b:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.51:*:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.50:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.50:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.10:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.00:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.00:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.54:update2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.54:update1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.0:beta1_v2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.11:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:7.10:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.0:tp3:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.0:tp2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:6.0:tp1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.60:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.52:beta2:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.52:beta1:*:*:*:*:*:*
  • OR cpe:/a:opera:opera_browser:10.54:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:11856
    V
    		Remote code execution in Opera before 10.60 due to failure to prevent certain double-click operations from running a program located on a web site.
    2013-12-23
    BACK
    opera opera browser *
    microsoft windows -
    apple macos -
    opera opera browser 5.11
    opera opera browser 6.03
    opera opera browser 6.04
    opera opera browser 6.05
    opera opera browser 7.01
    opera opera browser 7.02
    opera opera browser 6.06
    opera opera browser 6.0
    opera opera browser 7.11
    opera opera browser 7.20
    opera opera browser 7.51
    opera opera browser 7.52
    opera opera browser 9.24
    opera opera browser 9.23
    opera opera browser 9.25
    opera opera browser 9.26
    opera opera browser 9.27
    opera opera browser 9.0 beta1
    opera opera browser 9.0 beta2
    opera opera browser 7.50
    opera opera browser 9.50
    opera opera browser 9.50 beta2
    opera opera browser 9.50 beta1
    opera opera browser 9.20 beta1
    opera opera browser 8.0 beta3
    opera opera browser 8.0 beta2
    opera opera browser 8.0 beta1
    opera opera browser 7.50 beta1
    opera opera browser 7.22
    opera opera browser 7.21
    opera opera browser 7.20 beta7
    opera opera browser 7.10
    opera opera browser 7.03
    opera opera browser 7.0 beta2
    opera opera browser 7.0 beta1
    opera opera browser 6.02
    opera opera browser 6.01
    opera opera browser 6.0 beta1
    opera opera browser 5.0
    opera opera browser 5.10
    opera opera browser 5.12
    opera opera browser 9.60
    opera opera browser 9.61
    opera opera browser 9.62
    opera opera browser 9.60 beta1
    opera opera browser 9.63
    opera opera browser 9.10
    opera opera browser 9.21
    opera opera browser 8.54
    opera opera browser 7.53
    opera opera browser 7.54
    opera opera browser 7.0
    opera opera browser 7.23
    opera opera browser 8.01
    opera opera browser 7.60
    opera opera browser 8.51
    opera opera browser 8.53
    opera opera browser 8.02
    opera opera browser 8.50
    opera opera browser 9.01
    opera opera browser 9.0
    opera opera browser 8.52
    opera opera browser 8.0
    opera opera browser 9.20
    opera opera browser 9.12
    opera opera browser 9.02
    opera opera browser 9.22
    opera opera browser 5.0 beta2
    opera opera browser 5.0 beta3
    opera opera browser 5.0 beta4
    opera opera browser 5.0 beta5
    opera opera browser 5.0 beta6
    opera opera browser 5.0 beta7
    opera opera browser 5.0 beta8
    opera opera browser 5.02
    opera opera browser 6.0 beta2
    opera opera browser 6.0 beta3
    opera opera browser 9.52
    opera opera browser 9.51
    opera opera browser 9.64
    opera opera browser 10.00 beta3
    opera opera browser 10.01
    opera opera browser 10.00
    opera opera browser 10.10
    opera opera browser 10.50
    opera opera browser 10.52
    opera opera browser 10.53
    opera opera browser 10.53 b
    opera opera browser 10.51
    opera opera browser 10.50 beta2
    opera opera browser 10.50 beta1
    opera opera browser 10.10 beta1
    opera opera browser 10.00 beta2
    opera opera browser 10.00 beta1
    opera opera browser 7.54 update2
    opera opera browser 7.54 update1
    opera opera browser 7.0 beta1_v2
    opera opera browser 7.11 beta2
    opera opera browser 7.10 beta1
    opera opera browser 6.0 tp3
    opera opera browser 6.0 tp2
    opera opera browser 6.0 tp1
    opera opera browser 10.60 beta1
    opera opera browser 10.52 beta2
    opera opera browser 10.52 beta1
    opera opera browser 10.54