Opera < 11.64 URL Parsing Memory Corruption

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(59089);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/27");

  script_cve_id("CVE-2012-3561");
  script_bugtraq_id(53474);

  script_name(english:"Opera < 11.64 URL Parsing Memory Corruption");
  script_summary(english:"Checks version number of Opera");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web browser that is potentially affected
by a memory corruption vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Opera installed on the remote Windows host is earlier
than 11.64 and is, therefore, potentially affected by a memory
corruption vulnerability. 

Certain crafted URLs can cause the application to allocate incorrect
amounts of memory and overwrite unrelated memory. This corruption can
then lead to application crashes or even arbitrary code execution.");
  script_set_attribute(attribute:"see_also", value:"http://www.opera.com/support/kb/view/1016/");
  # http://web.archive.org/web/20170706175946/http://www.opera.com/docs/changelogs/windows/1164/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c2be59ef");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Opera 11.64 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-3561");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/05/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/05/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:opera:opera_browser");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2012-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("opera_installed.nasl");
  script_require_keys("installed_sw/Opera");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Opera', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '11.64.1403.0'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);