The TLS implementation in Opera before 12.13 does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

The remote host is affected by the vulnerability described in GLSA-201406-14 (Opera: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Opera. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       page using Opera, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
      Furthermore, a remote attacker may be able to obtain sensitive       information, conduct Cross-Site Scripting (XSS) attacks, or bypass       security restrictions.
    A local attacker may be able to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Opera was updated to 12.14 version fixing stability issues. This update also consists updates for Opera 12.13 which is a recommended upgrade offering security and stability enhancements.

-fixed an issue where Opera gets internal communication errors on Facebook

-fixed an issue where no webpages load on startup, if Opera is disconnected from the Internet

-fixed an issue where images will not load after back navigation, when a site uses the HTML5 history API (deviantart.com)

-improved protection against hijacking of the default search, including a one-time reset

-fixed an issue where DOM events manipulation might be used to execute arbitrary code;

-fixed an issue where use of SVG clipPaths could allow execution of arbitrary code;

-CVE-2013-1618: Fixed a TLS information leak.

-fixed an issue where CORS requests could omit the preflight request;

The remote host is running the Opera web browser.

Versions of Opera earlier than 12.13 are potentially affected by the following vulnerabilities :

  - An error exists related to DOM manipulation that could lead to application crashes or arbitrary code execution. (1042)

  - An error exists related to SVG 'clipPaths' that could lead to memory corruption or arbitrary code execution. (1043)

  - The application could fail to make the proper 'pre-flight' Cross-Origin Resource Sharing (CORS) requests. In some situations this error could aid an attacker in cross-site request forgery (XSRF) attacks. (1045)

  - An unspecified, low severity issue exists that has an unspecified impact.

The remote host is running the Opera web browser. 

Versions of Opera earlier than 12.13 are potentially affected by the following vulnerabilities :

  - An error exists related to DOM manipulation that could lead to application crashes or arbitrary code execution. (1042)

  - An error exists related to SVG 'clipPaths' that could lead to memory corruption or arbitrary code execution. (1043)

  - The application could fail to make the proper 'pre-flight' Cross-Origin Resource Sharing (CORS) requests. In some situations this error could aid an attacker in cross-site request forgery (XSRF) attacks. (1045)

  - An unspecified, low severity issue exists that has an unspecified impact.

The version of Opera installed on the remote host is earlier than 12.13 and is, therefore, reportedly affected by the following vulnerabilities :

  - An error exists related to DOM manipulation that could     lead to application crashes or arbitrary code     execution. (1042)

  - A use-after-free error exists related to SVG 'clipPaths'     that could lead to memory corruption or arbitrary code     execution. (1043)

  - An error exists related to the TLS protocol, CBC mode     encryption and response time. An attacker could obtain     plaintext contents of encrypted traffic via timing     attacks. (1044)

  - The application could fail to make the proper 'pre-     flight' Cross-Origin Resource Sharing (CORS) requests.
    In some situations this error could aid an attacker in     cross-site request forgery (CSRF) attacks. (1045)

  - An unspecified, low severity issue exists that has an     unspecified impact.

ID	Name	Product	Family	Severity
76065	GLSA-201406-14 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
74888	openSUSE Security Update : Opera (openSUSE-SU-2013:0289-2)	Nessus	SuSE Local Security Checks	medium
800848	Opera < 12.13 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6680	Opera < 12.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
64363	Opera < 12.13 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-1618

medium

Tenable Plugins

high

medium

high

high

high