News
Vigil@nce: Opera, two vulnerabilities
March 2010 by Vigil@nce
Two vulnerabilities were announced in Opera. The first one can be used to inject data in a TLS session.
Severity: 2/4
Consequences: data creation/edition
Provenance: internet server
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Number of vulnerabilities in this bulletin: 2
Creation date: 02/03/2010
IMPACTED PRODUCTS
Opera
DESCRIPTION OF THE VULNERABILITY
Two vulnerabilities were announced in Opera.
A remote attacker can use a vulnerability of TLS in order to insert pain text data during a renegotiation via a man-in-the-middle attack (VIGILANCE-VUL-9181 (https://vigilance.fr/tree/1/9181)). [severity:2/4; BID-36935, CVE-2009-3555, VU#120541]
Another vulnerability was announced, but its technical details are unknown. [severity:2/4]
CHARACTERISTICS
Identifiers: BID-36935, CVE-2009-3555, VIGILANCE-VUL-9484,
VU#120541
Url: http://vigilance.fr/vulnerability/O...
