CVE Vulnerabilities

CVE-2009-2063

Improper Authentication

Published: Jun 15, 2009 | Modified: Aug 17, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https sites context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Opera_browser Opera * 9.24 (including)
Opera_browser Opera 1.00 (including) 1.00 (including)
Opera_browser Opera 2.00 (including) 2.00 (including)
Opera_browser Opera 2.10 (including) 2.10 (including)
Opera_browser Opera 2.10-beta1 (including) 2.10-beta1 (including)
Opera_browser Opera 2.10-beta2 (including) 2.10-beta2 (including)
Opera_browser Opera 2.10-beta3 (including) 2.10-beta3 (including)
Opera_browser Opera 2.12 (including) 2.12 (including)
Opera_browser Opera 3.00 (including) 3.00 (including)
Opera_browser Opera 3.00-beta (including) 3.00-beta (including)
Opera_browser Opera 3.10 (including) 3.10 (including)
Opera_browser Opera 3.21 (including) 3.21 (including)
Opera_browser Opera 3.50 (including) 3.50 (including)
Opera_browser Opera 3.51 (including) 3.51 (including)
Opera_browser Opera 3.60 (including) 3.60 (including)
Opera_browser Opera 3.61 (including) 3.61 (including)
Opera_browser Opera 3.62 (including) 3.62 (including)
Opera_browser Opera 3.62-beta (including) 3.62-beta (including)
Opera_browser Opera 4.00 (including) 4.00 (including)
Opera_browser Opera 4.00-beta2 (including) 4.00-beta2 (including)
Opera_browser Opera 4.00-beta3 (including) 4.00-beta3 (including)
Opera_browser Opera 4.00-beta4 (including) 4.00-beta4 (including)
Opera_browser Opera 4.00-beta5 (including) 4.00-beta5 (including)
Opera_browser Opera 4.00-beta6 (including) 4.00-beta6 (including)
Opera_browser Opera 4.01 (including) 4.01 (including)
Opera_browser Opera 4.02 (including) 4.02 (including)
Opera_browser Opera 5.0 (including) 5.0 (including)
Opera_browser Opera 5.0-beta2 (including) 5.0-beta2 (including)
Opera_browser Opera 5.0-beta3 (including) 5.0-beta3 (including)
Opera_browser Opera 5.0-beta4 (including) 5.0-beta4 (including)
Opera_browser Opera 5.0-beta5 (including) 5.0-beta5 (including)
Opera_browser Opera 5.0-beta6 (including) 5.0-beta6 (including)
Opera_browser Opera 5.0-beta7 (including) 5.0-beta7 (including)
Opera_browser Opera 5.0-beta8 (including) 5.0-beta8 (including)
Opera_browser Opera 5.02 (including) 5.02 (including)
Opera_browser Opera 5.10 (including) 5.10 (including)
Opera_browser Opera 5.11 (including) 5.11 (including)
Opera_browser Opera 5.12 (including) 5.12 (including)
Opera_browser Opera 6.0 (including) 6.0 (including)
Opera_browser Opera 6.0-beta1 (including) 6.0-beta1 (including)
Opera_browser Opera 6.0-beta2 (including) 6.0-beta2 (including)
Opera_browser Opera 6.0-tp1 (including) 6.0-tp1 (including)
Opera_browser Opera 6.0-tp2 (including) 6.0-tp2 (including)
Opera_browser Opera 6.0-tp3 (including) 6.0-tp3 (including)
Opera_browser Opera 6.1 (including) 6.1 (including)
Opera_browser Opera 6.01 (including) 6.01 (including)
Opera_browser Opera 6.1-beta1 (including) 6.1-beta1 (including)
Opera_browser Opera 6.02 (including) 6.02 (including)
Opera_browser Opera 6.03 (including) 6.03 (including)
Opera_browser Opera 6.04 (including) 6.04 (including)
Opera_browser Opera 6.05 (including) 6.05 (including)
Opera_browser Opera 6.06 (including) 6.06 (including)
Opera_browser Opera 6.11 (including) 6.11 (including)
Opera_browser Opera 6.12 (including) 6.12 (including)
Opera_browser Opera 7.0 (including) 7.0 (including)
Opera_browser Opera 7.0-beta1 (including) 7.0-beta1 (including)
Opera_browser Opera 7.0-beta1_v2 (including) 7.0-beta1_v2 (including)
Opera_browser Opera 7.0-beta2 (including) 7.0-beta2 (including)
Opera_browser Opera 7.01 (including) 7.01 (including)
Opera_browser Opera 7.02 (including) 7.02 (including)
Opera_browser Opera 7.03 (including) 7.03 (including)
Opera_browser Opera 7.10 (including) 7.10 (including)
Opera_browser Opera 7.10-beta1 (including) 7.10-beta1 (including)
Opera_browser Opera 7.11 (including) 7.11 (including)
Opera_browser Opera 7.11-beta2 (including) 7.11-beta2 (including)
Opera_browser Opera 7.20 (including) 7.20 (including)
Opera_browser Opera 7.20-beta7 (including) 7.20-beta7 (including)
Opera_browser Opera 7.21 (including) 7.21 (including)
Opera_browser Opera 7.22 (including) 7.22 (including)
Opera_browser Opera 7.23 (including) 7.23 (including)
Opera_browser Opera 7.50 (including) 7.50 (including)
Opera_browser Opera 7.50-beta1 (including) 7.50-beta1 (including)
Opera_browser Opera 7.51 (including) 7.51 (including)
Opera_browser Opera 7.52 (including) 7.52 (including)
Opera_browser Opera 7.53 (including) 7.53 (including)
Opera_browser Opera 7.54 (including) 7.54 (including)
Opera_browser Opera 7.54-update1 (including) 7.54-update1 (including)
Opera_browser Opera 7.54-update2 (including) 7.54-update2 (including)
Opera_browser Opera 7.60 (including) 7.60 (including)
Opera_browser Opera 8.0 (including) 8.0 (including)
Opera_browser Opera 8.0-beta1 (including) 8.0-beta1 (including)
Opera_browser Opera 8.0-beta2 (including) 8.0-beta2 (including)
Opera_browser Opera 8.0-beta3 (including) 8.0-beta3 (including)
Opera_browser Opera 8.01 (including) 8.01 (including)
Opera_browser Opera 8.02 (including) 8.02 (including)
Opera_browser Opera 8.50 (including) 8.50 (including)
Opera_browser Opera 8.51 (including) 8.51 (including)
Opera_browser Opera 8.52 (including) 8.52 (including)
Opera_browser Opera 8.53 (including) 8.53 (including)
Opera_browser Opera 8.54 (including) 8.54 (including)
Opera_browser Opera 9.0 (including) 9.0 (including)
Opera_browser Opera 9.0-beta1 (including) 9.0-beta1 (including)
Opera_browser Opera 9.0-beta2 (including) 9.0-beta2 (including)
Opera_browser Opera 9.01 (including) 9.01 (including)
Opera_browser Opera 9.02 (including) 9.02 (including)
Opera_browser Opera 9.10 (including) 9.10 (including)
Opera_browser Opera 9.12 (including) 9.12 (including)
Opera_browser Opera 9.20 (including) 9.20 (including)
Opera_browser Opera 9.20-beta1 (including) 9.20-beta1 (including)
Opera_browser Opera 9.21 (including) 9.21 (including)
Opera_browser Opera 9.22 (including) 9.22 (including)
Opera_browser Opera 9.23 (including) 9.23 (including)

Potential Mitigations

References