Security News

Opera Software has released Opera 12.15 for Mac, offering security and stability enhancements. The recommended upgrade fixes three vulnerabilities, including one moderately severe issue and two low severity issues.

While details of the moderately severe flaw are to be released at a later date to protect Opera users who have not yet installed Opera 12.15, the company’s security advisory included further information about the low severity issues. Opera Software added safeguards against certain brute force attacks on a popular but vulnerable RC4 encryption protocol, and also fixed an issue where cookies can be set for a top-level domain.

On the precariousness of RC4, Opera Software reassured any concerned users that an attack against RC4 is “infeasible against regular web surfers,” because any attempt to exploit the flaw would require consuming all available bandwidth 24 hours a day for several days to accomplish.

Opera Software described the RC4 issue and their resolution as follows:

Weaknesses in the RC4 encryption protocol have been found, allowing an attacker to deduce the plaintext. If the same message is encrypted many millions of times, statistical methods can be used to extract valuable information, such as cookies. Due to the time this amount of requests takes, this is not a practical attack against most users.

Opera Software has released Opera 12.15, where safeguards against such attacks have been added. On vulnerable connections, Opera will add some random data, making statistical methods less effective. If a domain makes an unrealistically high number of requests in less than 24 hours, it will be treated as an attack, and Opera will block that domain for the remainder of the 24 hours.

On the issue where cookies can be set for a top-level domain, Opera’s security advisory described the low severity flaw as follows:

Browsers should only allow cookies to be set for the website that created them. In some specific cases, Opera does not apply this restriction correctly, and allows a website to set a cookie for its entire top-level domain (such as .com or .co.uk). A malicious site could then redirect the user to another website in the same top-level domain, causing that site to receive the cookie. In some cases, this may confuse a site’s cookie handling, causing it to mistake that cookie for one of its own, and reusing it for authentication without modification. This could lead to the user’s accounts being compromised on that site.

Mac users can update their software using Opera’s built-in updater (choose Opera > Check for Updates), through its auto-updater (this can be turned on in Preferences > Advanced > Security), or from the Opera website.