Argument injection vulnerability in Opera before 7.50 does not properly filter "-" characters that begin a hostname in a telnet URI, which allows remote attackers to insert options to the resulting command line and overwrite arbitrary files via (1) the "-f" option on Windows XP or (2) the "-n" option on Linux.

iDEFENSE identified a vulnerability in the Opera web browser that could be used by remote attackers to create or truncate arbitrary files on the victims machine. The KDE team discovered that a similar vulnerability exists in KDE.

A remote attacker could entice a user to open a carefully crafted telnet URI which may either create or truncate a file in the victims home directory. In KDE 3.2 and later versions the user is first explicitly asked to confirm the opening of the telnet URI.

The remote host is affected by the vulnerability described in GLSA-200405-19 (Opera telnet URI handler file creation/truncation vulnerability)

    The telnet URI handler in Opera does not check for leading '-'     characters in the host name. Consequently, a maliciously-crafted     telnet:// link may be able to pass options to the telnet program     itself. One example would be the following:
    telnet://-nMyFile     If MyFile exists in the user's home directory and the user clicking on     the link has write permissions to it, the contents of the file will be     overwritten with the output of the telnet trace information. If MyFile     does not exist, the file will be created in the user's home directory.
  Impact :

    This exploit has two possible impacts. First, it may create new files     in the user's home directory. Second, and far more serious, it may     overwrite existing files that the user has write permissions to. An     attacker with some knowledge of a user's home directory might be able     to destroy important files stored within.
  Workaround :

    Disable the telnet URI handler from within Opera.

The remote Opera Web Browser is vulnerable to at least 20 bugs.  An attacker, exploiting these flaws, would be able to execute code on the remote system.  The attacker would need to be able to coerce the local Opera user to browse to a malicous website. 

ID	Name	Product	Family	Severity
15355	Debian DSA-518-1 : kdelibs - unsanitised input	Nessus	Debian Local Security Checks	high
14505	GLSA-200405-19 : Opera telnet URI handler file creation/truncation vulnerability	Nessus	Gentoo Local Security Checks	low
1243	Opera Web Browser < 7.5.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
800838	Opera Web Browser < 7.5.4 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2004-0473

high

Tenable Plugins

high

low

medium

medium