Slashdot Mirror
Opera 7.0 Security Holes ... Fixed
An anonymous reader writes "GreyMagic has issued five new security advisories for the recently-released Opera 7.0. They affect the security model, the javascript console, images, the history and the error log (allowing access to the history). A new version will be released within 24 hours to fix the holes, according to an article at The Register." Update: 02/05 02:01 GMT by T : An anonymous reader writes "Opera Software have just released Opera 7.01 for Windows. This version fixes the recently discovered security holes less than 24 hours after they were discovered - a very impressive turnaround! The release is currently only available on Opera's FTP site. It can be downloaded with Java (12.9Mb) or without (3.3Mb)."
Thank god I'm using IE!
Only the State obtains its revenue by coercion. - Murray Rothbard
Seems like that list would be shorter.
I don't need no instructions to know how to rock!!!!
It's nice to see that there's a speedy 24 hour turnaround on the fixes... even so I think I'll stick to my tried and true v6.03 :)
There is no Opera 7 for Mac OS X. is it becuase the safari browser? See This article (slashdot.org)
The package said "Windows XP or better. Pentium Class Processor or better"... So I got a Mac with OS X
Opera 7 is nice but I am disinclined to put any new version of a browser on a critical computer. Other cautious types won't have been inconveienced greatly either.
I like mouse gestures, but I don't know what to make of the new spatial navigation feature. yet.
Last time there was a serious browser security problem KDE got Konqueror fixed by evening,Opera had fixes on one platform after a day and another platform after a couple of days, and Mozilla was about a sgood.
Many of my colleagues were still using the only major browser that took a week before anyone admitted they owned a problem, when the fix eventually came out.
I think this is long overdue. The last time I checked out opera, several people were murdered (including one by a barber - terrorists with nail clippers indeed!). On a previous excursion there was an actual war, culminating in the death of a cigarette girl. This kind of thing just has to stop, so the prospect of increased security is a welcome one. In the past the only evidence of surveillance has been a few people in fancy dress with cheap, tiny binoculars. That's just a recipe for anarchy.
Some ear protection would be nice too.
Would BUY a web browser? These things are commodity now in the terms of operating systems. We have IE and Mozilla for Windows, KHTML and Mozilla for Linux, and IE and Mozilla and KHTML for Mac.
We have Mouse gestures for Moz by plugin, Tabbed bowsing for Moz and Konq, and any other feature deemed ok can easily be added in to Mozilla (either by source adds or plugins).
Can somebody answer me why someone would buy a web bowser these days?
Is Safari available on Linux?
Je ne parle pas francais.
There are workarounds it says until the patch, just turn off javascript.. that gets rid of 4 of 5 holes. 5th hole is plugged by changing
/\\/g, "\\\\" ) +
/\\/g, "\\\\").replace(/"/g,"")+
m.replace(
on line 52 of "console.html" in Opera's install dir with:
m.replace(
It seems. With the barrage of security flaws in IE, Mozilla, Netcape, and Opera, it seems it doesn't matter if you pay or not!
Or it could be that others are coming up with increasingly more ingenious ways to get around existing security and everyone is making sure they don't get caught with their pants down.
Of course, you can always go with uncle steve on his safari and just believe the software is perfect as apple pie. I'd rather update and though it's a pain in the ass, at least know some holes are plugged from time to time (as new ways to subvert security are created) than lull myself into believing that security is ever Perfect from the get go.
Conclusion: Updates good... Ignorance bad
-Joe
If we're all god's children, what's so special about Jesus? - Jimmy Carr
Safari is based on KHTML, so if you use Konquerer you'll have a similar experience. HTH, HAND.
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
Furthermore, in an application - the problem of cohesion and coupling will forever rise. Unfortunately, many applications have modules that are heavily linked so when you ask "What isn't affected?", you aren't considering how many applications are programmed. Frankly, if module A is broken, in many, many cases where the design team was on the project for two weeks and the coding team never even talked to the design team, this would mean that B - F are also broken. I'm not saying this is a problem with Opera but some security flaws in a given module will often result in flaws being found in others.
I hate liberals. If you are a liberal, do not reply.
"You are using OS X, right?"
IMHO, Safari will migrate soon enough.
Mozilla is slow as molasses on anything less than a Ghz+ machine.
IE is so full of holes, and no feasible way to kill popups short of crippling the browser.
Your point again was?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Those are the main reasons. It's well worth the small price to get a browser with so many good features. I find it amazing that anyone chooses to use IE!!!!
"Would it kill you to put down the toilet seat?" -- Maya Angelou
but opera surely does rock!! I have tried Mozilla, Pheonix, and IE, and also Konqueror and some other browser on linux which I tested a while ago, and well.. sorry, but opera is by far the best browser I've ever used.. I would mourn if it suddenly went bankrupt or whatever, as non of the other browsers are good enough for me after having used opera. Of course, things are looking fairly good for opera and their future, even though they're competing in the deadliest of markets - this hold true especially for the portable market. When discussing opera and browsers, someone always comes on and says why not use pheonix instead?? I will tell you something.. to me, pheonix feels almost as bloated as mozilla.. it's just something with the.. interface.. difficult to describe.. even the renderer feels slower, or in some other way inferior to the one of opera, but.. the show stops already with the user interface.. there's just something not completely right about it.. opera has nothing too fancy in the way of interface design, but it just works and feels very good. So some seem to think us opera users just make stupid claims.. tell me this.. why the hell would i bother to pay for opera if pheonix is just as good or even better as many claim? For me, it simply isn't.. besides, opera has some functionality moz/pheonix cannot offer me yet.
Besides the improvements, KHTML is identical to the KHTML used in Safari. So its not unreasonable to compare the two.
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
You shouldn't put any browser on a Critical Computer.
"Would it kill you to put down the toilet seat?" -- Maya Angelou
I know it might not help much, but all Opera user should give Phoenix a shot.
:)
:) (yeah, kudos to Phoenix developers!)
I used Opera and I really like it very much as its efficiency and functionalities can really beat any other alternatives. However, I failed to get Java and flash work properly on Linux, it always has some glitches here and there. Opera works fine in this regard in Windows, though.
Then I gave Phoenix a try. To my surprise, not only java and flash works flawlessly, its performance is even comparable to Opera! Although it doesn't have the same functionalities I'd find in Opera, but I can install extensions to enhance its usabilities. Above all, it wouldn't give you annoying banner ad(yes I didnt pay for Opera
I just tell from my experience, and I've no association with Phoenix development team.
I have a feeling the number of grandmas using Opera 7 is pretty small, though.
What Edball mentioned is a temporary fix until the patches are released. They will hopefully be more user friendly.
--
"I'm surfin the dead zone
In the twilight, unknown"
Opera comes up with security problems, and they're fixed in short order.
IE has one big security problem (script support) and a whole bunch of little ones, and the patches come, well, when they get around to it.
Conclusion: Well, you decide for yourself...
This Post Made From Within Opera (6.0)
According to this forum thread, it said "Grey Magic looking at the alert said they informed Opera in Nov. of the problems in beta 1 of version 7. In beta 2 Opera thought they had fixed it but instead had only fixed part and not all. On Jan. 31 Grey Magic informed Opera of these problems in version 7 final , Opera asked for the to wait till Feb. 6 before announcing so that they could have it fixed , Grey Magic chose not to wait just 2 more days."
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
...that full disclosure of security issues is not in the publics interest. Opera has aggressively been working on the problems, and has released 7.01 which (AFAIK) fixes said problems. However, they did not have reasonable time to address each issue once found.
It's one thing when a company sits on an exploit for a month without even aknowledging it. It's another when a company acknowledges it, and requests a reasonable amount of time to make a fix, and regression test that fix. Sheeshe, give these guys a break - they patched very quickly and from what it looks like it's a stable patch.
There is no longer anything that can be done with computers that is nontrivial and clearly legal. -- Paul Phillips
Programmer1: Ouch! Somebody just discovered some security holes in our browser!
Programmer2: Yeah, I saw that too. I was working on it all morning, but I believe I've fixed all the outstanding issues in our code. Now we just need to notify our user base.
Programmer1: Yup. You gonna call him, or should I?
*RIMSHOT*
Yes, it is, because the code Apple released back to the KDE developers makes the browser fly.
= 4
http://promo.kde.org/3.1/feature_guide.php?page
"Much attention has recently been showered on the KDE HTML rendering engine due to its adoption by Apple in its Safari browser. While some of the efforts of the Safari developers have found their way into KDE 3.1, the vast majority of the Apple developers' performance, rendering and JavaScript improvements which will be incorporated into KHTML are scheduled for release with KDE 3.2."
Yes, Apple, with its large web browser marketshare, is producing a browser that is causing people to migrate away from Opera on no less than 8 operating systems.
Look, I love OS X. (well, mainly Cocoa and Aqua.. well, and Quartz Extreme... and Rendezvous.. and..) But saying Safari is driving Opera out of the market is goofy.
slashdot!=valid HTML
Comment removed based on user account deletion
that has to be some sort of record for a big fix. anyone know if these were discovered after the 7.0 release or if it was something known before that were saved till after the release to polish up?
It chaps my butt just a bit that Opera did not have the courtesy to send me an email letting me know that a new version was available. I registered my Windows and Linux versions. Maybe their email server is buggy too.
But, with an Athlon under your desk, you'll be able to light those cigars from the fire that starts as soon as the processor gets up to operating temp. No need to waste the bills...you might as well get that Apple you know you want :)
By the way, I run OS X and Mandrake...on an Athlon. The Athlon was in a used box I picked up, and was running at 68 deg. C. I replaced the fan and heat sink and it's down to 48 deg. C now. My G4 runs at 38, as I recall.
Wrote 'em an email complaining about their security-through-obscurity model, and had a reply back from a developer within ten minutes, pointing me to the FTP site with the fixed version...
:)
That's not a bad response at all, IMHO.
And no, I don't work for 'em - are they hiring at the moment?
Actually, no, Opera has almost no marketshare in OSX. it's either IE, Safari, Chimera and Mozilla. Opera is a very distant fifth on OSX.
It's just hit their FTP servers. If you've signed up for their announcement newsletter (which you get the option to do during your purchase as I recall) then you'll know as soon as they announce it no doubt.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Yes, I know the parent was sarcastic.
It's hard to be religious when certain people are never incinerated by bolts of lightning.
I use mozilla, so I really can't speak for opera
a piece of shitty software
Translation: I never used it, but opera is shitty, because payment is optional.
Vote for global prefs bug
Programmer2: Nah... lets just post it on slashdot.
Interactive Visual Medical Dictionary
I think I know where you were trying to go with your statement. They offer two different d/l's, both use Java, one has it included in the download (12.9MB) and the other is if you already have a version of Java installed (3.3MB).
Maybe 24 hours since it's been reported here, but look at the error reports, the latest report is dated January 29th, the earliest is from November (a variant of the hole in question).
For the alpha previews of their unix versions, go here.
Escher was the first MC and Giger invented the HR department.
I look on slashdot and see that my current browser had security holes, and an update saying that it's already fixed and where to get the fixed version. I love Opera. It makes me happy. If only other *coughmicrosoftcough* companies would learn from this!
~Jon~
This space for rent, inquire within.
The difference between KHTML 3.1 (used in KDE 3.1) and KHTML 3.2 (used in Safari and KDE 3.2) is more like the difference between Microsoft Internet Explorer 5 (used in Microsoft Windows 2000) and Microsoft Internet Explorer 5.5.2 (used in Microsoft Windows 2000 Service Pack 3). In other words, not much significant has changed.
Will I retire or break 10K?
Opera knew earlier about them. From a Bugtraq post:
4 e4 c94d7495e8166839fd2b242753&threadid=10657
For the five advisories posted today concerning Opera 7, I have not seen and information on when and how Opera Software was notified of the problems, and if they were/when planning for a fixed release.
Alright, after reading:
http://my.opera.com/forums/showthread.php?s=903
and:
http://theregister.co.uk/content/55/29177.html
It looks like Opera Software was notified 1/31, and asked for the announcement to be delayed until 1/6.
Was there a good reason to post the vulnerabilities today rather than thursday?
Apple ... is producing a browser that is causing people to migrate away from Opera on no less than 8 operating systems.
That's at least half right. I can think of at least four operating systems where Apple's contribution to the KHTML component may cause Opera's market share to decrease: Mac OS X Jaguar, Linux, FreeBSD, and Solaris operating environments. The X11 based version of Safari is called "Konqueror" and comes packaged with the forthcoming KDE 3.2 desktop environment.
Will I retire or break 10K?
I just fired up IE to about:blank, typed in www.slashdot.org, and it took it 7 seconds to load.
I did the exact same thing in Opera, and it took 3 seconds. Sure, it's not scientific, but it's very typical of the response times I see using the two browsers. And yes, I do use both because there are a number of asstards out there who make their sites IE only, and I must view them for work.
As for an example, I have a minor css thing on http://www.mzla.com/bible that doesn't appear at all in IE (highlighted text). I've seen plenty other examples, but am too lazy to find them now. The things I listed are well worth the money, in my book. If you don't find them worth the money, don't buy it, don't use it. It's your choice.
"Would it kill you to put down the toilet seat?" -- Maya Angelou
Well, I just tried out Opera 6 for Mac OS X and it was extremely slow, especially scrolling pages. Granted, I'm on a puny 500 MHz G3 iBook but still, it was bad. Much worse than either Chimera (for tab-lovers) or Safari (what I'm using these days). Probably the Windows version is a lot faster but on OS X it's not even in the race.
...wearing a skin-tight topless leather jumpsuit, with cutaway buttocks and transparent crotch panel.
Cheez u must know who this is lets use suse 8.1 for that IBM box.
If a post is pro-M$ and not obviously sarcastic we begin to wonder about your sanity.
You can't judge a book by the way it wears its hair.
you pulled that straight out of your ass.
That sounds more like it...I don't want hear 'burning down the house' on my way home some evening :)
This is a 1010 Athlon...what is the 'normal' temp for these things?
hehehe...okokok...
...and Mandrake on an Athlon -
...or...
:(
OS x.
I run OS X and Mandrake. Mandrake on an Athlon... No Opera.
Now watch someone start talking about OS X for ix86 all over again
I use IE for everything and set my own security levels and keep up to date with patches. Add a little shareware app called pop up stopper and its perfect. Tell me again why I need opera? I use what works for me, not what other people think is right.
Only the State obtains its revenue by coercion. - Murray Rothbard
I marklar marklar marklar Marklar. after all, marklar, marklar, marklar, marklar! Especially since Marklar marklar marklar marklar, and marklar marklar marklar.
MARKLAR!.
Yes, security through obscurity and all but shouldnt they have contacted Opera first to let them know and let them fix it before announcing them to the public? This isnt some 3 months-waiting-ms-bug, Opera 7 has been out for a month.
This sig was cut off by the sla
Dammit i PAID for opera and now i cant even download it.
6 is no where near as buggy as 7 & has much more mature features.
Afterall 7 is a beta.
The bookmarking folder setup is much more flexible too
What about huge the memory leaks that were in the beta 2? Did they fix those as well? Just curious.
It can be downloaded with Java (12.9Mb) or without (3.3Mb).
And we bitch at Microsoft for putting out bloatware? Yikes...
I love Opera, I just fell in love with it a week ago. the mouse gestures, the overall feel or the gui. I have a few problems with it though. One being that when I highlight text that is on a url, I cant save the actual text, I just have the option to save the URL . Also, the scroll feature in Opera is very buggy, I cant scroll while a page is loading or I have to have the mouse "inside" the area I am wanting to scroll, instead of just putting the cursor to the right and scrolling. It just wont let me! I found a serial # to get rid of the ads, so that I could try it out without the Ads ( I HATE ADS ) That way I could see how it REALLY looks like and feels like. I am putt off by these security holes Big time right now, I have patched the browser, and am still loving the experiance. I would be willing to pay for this Browser once a few bugs and really obvious funtions are added. Another side affect of using Opera, is you start to do mouse gestures in other applications lol LMOA I mean It really is a wonderful thing, I wouldnt go back to IE or Mozilla ( shudder ) again.
If Opera was compatiable with all sites then would it be set as a default browser?
IE would have no use and Opera would take over! Surely Opera is more Superior to IE if it was compatiable with all sites.
I love Opera, I just fell in love with it a week ago
Let me tell you something that all of us geeks should remember for future encounters with women: it's not love after a week, it's lust :)
It all goes downhill from first post
Lust is what you could decribe my facination with the usability of this browser lol
Let me explain: Opera have shown their willingness to innovate and add new features to their browser. And they're good at it. Many of their ideas are very useful, *and* they're designed to benefit the user rather than create new "standards" to try and lock in developers.
Opera promoted the ideas of tabbed browsing and mouse gestures, ideas that were taken up by many Gecko-based browsers. The new release adds and intelligent "forward" button, understanding of navigational META tags, and small screen rendering.
If you watch Moz and Phoenix, you will see the influence of Opera - for example, the demand for Opera-style "rocker" gestures (using mouse button combos rather than movement) to be added to the gesture extensions.
Now, I'm not saying that Open Source projects should only clone and never innovate - and in fact, there are many innovations in Mozilla (pie menu navigation and type ahead find, for example). But Opera is a useful source of good interface ideas, and the company is not taking out bogus patents to "protect" them.
I'm a medical doctor.
My desktop computer is critical.
I need to look up stuff from our internal and external knowledge stores like the Dermatology advice (no URL offered by me!), and national electronic library for health GP Notebook and the US NIH, University of Iowa virtual hospital, that sort of stuff, while I'm dealing with patients.
In due course I may need to order (we say request) tests or further opinions which are accessed via a browser.
I think I need a browser on my critical computer.
I can do it by using the VNC session I maintain to the Linux machine on the network, and running the browser on that, but that makes cut and paste, and triggering a browser from a database noticeably more difficult.
Looked at GreyMagic's web site with Opera cookie notification on?
http://www.greymagic.com/This page wishes to set the cookie
ASPSESSIONIDXXXXXXXX="XXXXXXXXXXXXXXXXXXXXXXXX"
Replaced with Xs to protect the innocent. Not only www but also "security". It's brave of them to be the lab rats for their own research-- or something.
Did anybody see 'The Recruit'?
I'm pretty sure that at one point Colin Farrel was using a browser that said "Opera" in huge text across the top. I thought it was an interesting choice, given that more than half the audience has probably never heard of it.
Can anyone tell me why Opera Software doesn't release incremental upgrade patches? I know it's only a 3 meg download, but that's still considerable over my dial-up connection, and shouldn't be necessary for a .01 upgrade/security fix.
I need a browser that will run on 486s and low-end Pentiums with less than 64 megs of RAM. Opera is the only graphical choice on Windows for those old beasts.
Not only that, but there were workarounds for all 5 holes immediately. Four could be taken care of by turning off javascript, and the other could be fixed by modifying a line in one local html file. So I go without javascript for a couple of days until the fixed version comes out, boo-hoo. I am really glad that they implemented better pop-up blocking this time around (ala Moz), but am sad that I can't background skin my browser. Now I am just waiting for the the Linux version...
My beliefs do not require that you agree with them.
I am using Opera 7.0, and the banner ad displaying right now in it is: Surf Safely - Opera 7.01s Now Available
So I guess that makes it official. I think I am about to click my first banner ad ever. :-)
My beliefs do not require that you agree with them.
D'oh! Here is what I got when I clicked the banner ad:
Dear Internet User,
You are receiving this error page due to a problem with the configuration of the advertisement javascript or html coding. This error is isolated to a specific site or site subsection. We apologize for any inconvience caused.
My beliefs do not require that you agree with them.
First of all, let me make it clear that I would rather not pay for something if I can get it for free. Having said that the reasons I paid for Opera are:
1.Tabs
Say what you may about Knoq, phoenix having tabbed browsing. But Opera what the first and does now has even more tabbed features with ability to save tab sessions.
2. Gestures:
This is first to market and most elegant and intuitive gestures than the Moz plugin which caused me unpredicatable or inintentional behaviors with the gestures.
3. Kickass Download manager
The best download integration with browser. Stop start resume, etc,, With the new version you can download all the links in a page in just one operation.
4. Memory and Speed:
My normal usage takes only 20MB(I have 12 tabs open usually mostly java documentation that I can easily access) on minimizing it takes only 7MB.
5. Search integration
Believe it the searching google, amazon or ebay or your custom configuration is far superior to any browser out there.
Only negative I have is the rendering of pages. For example Yahoo! Mail had pull down menu. But I can't get it to work in Opera given that Yahoo! is a megaplex on the web.
So give it a try and you'll never turn back just I did.
If it makes your life better thank Opera team and you'll be better for it.
Sigh, Dang thing still crashes everytime I go to a yahoo news site.
At least it has the decency to restart back in the last known good state. I really hope they get that on fixed soon. I love the browser just a few bugs left to fix.
Just like checking your oil/coolant in a vehicle on a regular basis, keeping an eye on security vulns in software you use is part of the responsibility of owning a computer and using it on a network.
Failure to do any of the above results in job security for auto mechanics and "IT technicians", such as myself.
Right, so I post that I dislike a product (and GIVE REASONS WHY!, i.e. I dislike the rendering engine and it's speed compared to alternatives) and it's modded as 'flamebait'?
Ooh he said something mean about a product he doesn't like! That's flamebait!
The origional post I replied to is a far better canidate for 'flamebait'.
I STILL don't like Opera and I STILL think it's a worse product than Omiweb, Safari, Konquerer, Galeon, Mozilla, Internet Explorer and iCab (though in the case of the latter, only just).
Furthermore, the reason many people dislike it has STILL gto nothing to do with cost as the origional post suggested (otherwise I would clearly not have paid for Netscape or Omniweb - for which payment was OPTIONAL and neither punished you with adverts for not purchasing).