Developers › Desktop Team blog
Opera 11.52 Security update
Hello Everyone
We have now released 11.52 addressing a 0 day security issue. We have at the same time thrown in some stability fixes.
Read more on the irresponsible disclosure of the exploit on the security team blog.
Changelogs can be found:
Windows
Mac
Linux
We have now released 11.52 addressing a 0 day security issue. We have at the same time thrown in some stability fixes.
Read more on the irresponsible disclosure of the exploit on the security team blog.
Changelogs can be found:
Windows
Mac
Linux
Readers' comments
Comments left by My Opera members under the original post: the first 50, as archived.
About this article
| Published in | Desktop Team blog |
|---|---|
| Date | October 19, 2011 |
| Author | olli |
| Tags | security, responsibility!, exploit |
| Original | Internet Archive |
Ravindran NavaneethanRavindranWednesday, October 19, 2011 8:42:54 AM
Ruarí ØdegaardruarioWednesday, October 19, 2011 8:44:57 AM
Originally posted by Ravindran:
Your OS is?
netwolfWednesday, October 19, 2011 8:50:34 AM
(tried 5 times)
Ravindran NavaneethanRavindranWednesday, October 19, 2011 8:51:29 AM
Originally posted by ruario:
Windows 7 "Help -> Check for Update" throws following error message. "An error occurred while checking for new version of Opera"Fabienfc761Wednesday, October 19, 2011 8:52:24 AM
And Error 503 on http://www.opera.com/download/get.pl?id=34094&thanks=true&sub=true
olliWednesday, October 19, 2011 8:53:30 AM
Originally posted by Ravindran:
Seems like we are having some server issues :-/
Being looked into
Tenno Seremeltenno-seremelWednesday, October 19, 2011 8:54:29 AM
pinkoneWednesday, October 19, 2011 8:54:34 AM
Spadar ShutSpShutWednesday, October 19, 2011 9:12:15 AM
OMG, this should be CSS shaders!
tCfkaDAWednesday, October 19, 2011 9:15:04 AM
Originally posted by Ravindran:
+1GreLIWednesday, October 19, 2011 9:15:18 AM
Mac: ftp://ftp.opera.com/pub/opera/mac/1152/
Win: ftp://ftp.opera.com/pub/opera/win/1152/
Tenno Seremeltenno-seremelWednesday, October 19, 2011 9:16:27 AM
Danielweep86Wednesday, October 19, 2011 9:20:24 AM
alchemist11jonnyquesty2kWednesday, October 19, 2011 9:22:11 AM
By the way, site needs to be updated: http://www.opera.com/browser/tips/
"The Opera Turbo button turns green, indicating that it is enabled."
crash1Wednesday, October 19, 2011 9:39:00 AM
Originally posted by SpShut:
it's seems to be scrollless webpage technologyRuarí ØdegaardruarioWednesday, October 19, 2011 9:39:28 AM
Originally posted by tenno-seremel:
try againTenno Seremeltenno-seremelWednesday, October 19, 2011 9:56:04 AM
Originally posted by ruario:
Already did, see above. Thanks :}
KonstantinzxcatWednesday, October 19, 2011 9:59:38 AM
Only yesterday Stay Secure SD extension warned me about Opera vulnerability. Today fix is ready =)
Installed, thx!
p.s.: looks like 11.52 fixes twitter issues too. Great!!
Satan D. LucifersupertrolWednesday, October 19, 2011 10:07:09 AM
and the error is gone
also, is the new labs build today contained the "security fixes" in this build?
SeversEveronWednesday, October 19, 2011 10:07:30 AM
Originally posted by olli:
Nice try, where can we read on the irresponsible not-fixing-the-exploit-for-half-a-year since it's that long you know about it?
OperaCrashedWednesday, October 19, 2011 10:21:41 AM
dizdizlexikWednesday, October 19, 2011 10:25:51 AM
Originally posted by OperaCrashed:
You are assuming that Opera knew about this certain exploit?
Sergey LocksheenChamieWednesday, October 19, 2011 10:28:17 AM
Ravindran NavaneethanRavindranWednesday, October 19, 2011 10:31:19 AM
Originally posted by olli:
Thanks. update channel is working fine. Installed without any problem.SeversEveronWednesday, October 19, 2011 10:31:46 AM
Originally posted by dizlexik:
They got tipped on it a year ago. Google around. http://www.h-online.com/security/news/item/Critical-security-hole-in-current-version-of-Opera-1362504.htmldizdizlexikWednesday, October 19, 2011 10:38:05 AM
Originally posted by sEveron:
I don't know really. This article may actually suggest that Opera is telling us true that they were unable to reproduce that exploit.SeversEveronWednesday, October 19, 2011 10:50:21 AM
Originally posted by dizlexik:
It is not a different exploit, it is the same exploit adapted. That means they did not understand the mechanism and they did not patch it properly.
If Opera is unable to reproduce a known exploit for half a year, and instead of doing own research on it, they sit and wait for outside researchers to hold their hand through it,
while the hole still exists and can be found and used by people with evil intents, then who is the irresponsible one here?
Jose did not make the hole, he found it and pointed opera to it, they DID NOT fix it, whatever their reasons, being it incompetence or laziness, it wasn't fixed till today.
Others could have found the same hole in the meantime.
Jose does not owe anything to Opera, they do not pay him to fix their browser, he made a good gesture and they didn't use his help. That's irresponsible.
Effectively it's Opera who put us at risk. I'm starting to gather more Chrome plugins now.
NoFanboyNofanboyWednesday, October 19, 2011 11:29:56 AM
My primary interest is now getting the fix on Opera 12.0 alpha/beta ASAP, otherwise we all are vulnerable - stepping back to 11.52 is more or less impossible due to incompatibilites in the mail database. And I don't want to have 2 Opera installations on one PC (two caches, two mail systems, etc).
Tenno Seremeltenno-seremelWednesday, October 19, 2011 11:30:08 AM
olliWednesday, October 19, 2011 11:40:08 AM
Originally posted by sEveron:
The initial report, which was responsible and well intentioned, did not contain enough information to reproduce the issue in current releases. Our own security people tried, but were not able to do so. That's neither incompetence or laziness, it happens when not all the details are known. Requests for additional information did not get anything useful in response. When a researcher then found how to exploit it in current releases they choose not to tell us about it, but to make it public instead. That is not responsible disclosure, and it puts users at risk. If the researcher had passed these details to us, it could have been fixed before disclosure, and users would not have had to spend a week (or longer, as it may take them some time to update) exposed to this issue.
Lương Thế Minh QuangquangltmWednesday, October 19, 2011 12:01:13 PM
QuHnoWednesday, October 19, 2011 12:12:31 PM
I consider that to be the normal behavior of Opera because, according to several statistics, Opera has an average response time of less than a week until issues are fixed by an update.
The old exploit of this "Security Expert" didn't work with the actual stable version of Opera at the time he reported it, so Opera asked him for further details which he failed to provide.
What they can't reproduce they can't fix.
Now he wrote a modified - meaning: similar but new - exploit because the old one didn't work any more - meaning: It was de facto fixed, even if per chance by other changes - and put it in the wild as a ready-to-go exploit for script kiddies. That behavior is irresponsible and a shame in my opinion.
RickrskunathWednesday, October 19, 2011 12:28:04 PM
Are we ever going to see a fix for this? It used to work fine.
Ryandi SandicoyomoyoWednesday, October 19, 2011 12:36:58 PM
SeversEveronWednesday, October 19, 2011 12:43:54 PM
Originally posted by olli:
So you decided to not put more effort into research or communication with the researcher who pointed you to the problem, acting like the problem didn't exist. Still seems like incompetence or laziness. Whether it was a failure in technical expertise or communication, it was a failure, and the blame is on you, not on Jose, because it is you who we trust to ensure your browser is secure. It is you who we trust to WORK on security issues and communicating about them with independent specialists instead of waiting for others to WORK on that for you.
Originally posted by olli:
Since the hole didn't appear yesterday out of the blue, but was there all along for the past six months, users were at risk all along. It was only a matter of time before other people, not necessarily with good intentions would find the hole and abuse it. We don't know whether they did.
The release makes users aware of the problem and FORCES you to patch the thing and remove the risk.
I found about the exploit yesterday and closed my Opera immediately not intending to reopen it till the patch is available. So did most of my power-user friends. Today we have a patch and we are finally safe. We would not be safe, if Jose would not release the exploit, the only difference being that we would not KNOW we're vulnerable.
For me, the only entity who acted irresponsible in regards to this problem is Opera team. On top of that, not admitting your mistake puts you in bad light and makes security researchers less likely to communicate with you on the issues they discover in the future, if the only thing they can expect in return is being blamed for not doing enough effort to fix YOUR browser.
Charles SchlossChas4Wednesday, October 19, 2011 12:52:16 PM
3rd time using the auto update
NoFanboyNofanboyWednesday, October 19, 2011 1:07:39 PM
Originally posted by coyomoyo:
No, not yet, probably in the next build. I am also waiting for it since it is not possible to downgrade 12-Alpha to 11.52.
slalauretteWednesday, October 19, 2011 1:31:45 PM
Originally posted by sEveron:
What do you understand by the phrase "Instead of contacting Opera again, Vázquez has adapted the exploit for the current version 11.51 of Opera and has released it as a Metasploit module"?
Christophchristoph142Wednesday, October 19, 2011 1:37:05 PM
Originally posted by sEveron:
What the hell is wrong with you?
If a whole is - due to patches - not exploitable in current versions as it used to be in previous ones and now needs additional triggers to work, which were obviously NOT mentioned or at least known by the team, what do you expect them to do? This one is not the only exploit in the world. They cannot spend months of research on a topic which according to their tests seems to be fixed.
Nobody forces you to use Opera. If you think that ANY other browser out there is better and safer try it. I bet you won't be in a better condition... but at least stop moaning around and stop driving us nuts for gods sake!!!
Thanks to the team! You're doing an awesome job!
Ruarí ØdegaardruarioWednesday, October 19, 2011 1:39:35 PM
Originally posted by Nofanboy:
Opera Next and the Opera stable are designed to be installed side by side.NoFanboyNofanboyWednesday, October 19, 2011 1:44:12 PM
Originally posted by ruario:
I know, but I find it is more efficient (for the Opera devs!) if the Next version is used for everyday browsing. How should we find bugs if Opera Next rests on the HD drive and only the previous stable version is being used? That's why many of us are waiting for a vulnerability fix for Opera Next.
groggeWednesday, October 19, 2011 1:52:27 PM
I hope that won't happen again and I hope Opera has not any more such skeletons in their closet. What makes me really mad, is that instead of an apology to your users, you put the blame on Vazqzuez. That's very low.
As a long time user I would appreciate it more if security bugs are on the top of your todo list, then new web standards such as WebGL (you're last!) and then maybe a few new "cool" features if at all.
LucalucaviozziWednesday, October 19, 2011 2:02:38 PM
Sent reports.
FhuryWednesday, October 19, 2011 2:10:28 PM
olliWednesday, October 19, 2011 2:13:06 PM
Originally posted by grogge:
Please read :http://my.opera.com/securitygroup/blog/2011/10/19/about-the-svg-font-manipulation-vulnerability-that-was-fixed-in-11-52
groggeWednesday, October 19, 2011 2:17:40 PM
olliWednesday, October 19, 2011 2:21:32 PM
Originally posted by grogge:
No, read it again. We wanted information on how to reproduce the issue.
ChirpieWednesday, October 19, 2011 2:34:40 PM
Originally posted by sEveron:
I don't know why you keep spreading this lie. Even the reporter admits on his blog that it wasn't exploitable in the final version at the time. And even if it was, he never showed Opera how to do it.And why did he wait for several months before he did anything anyway?
We both know why. It wasn't exploitable, but he kept trying, and when he actually found a way to exploit it he did a zero-day instead of telling Opera about it.
Originally posted by sEveron:
That article pretty clearly states that the guy did not in fact report it to Opera, but chose to publish it irresponsibly instead:"Instead of contacting Opera again, Vázquez has adapted the exploit for the current version 11.51 of Opera and has released it as a Metasploit module."
Actually, Opera tried to contact the reporter but never got a reply.
He did NOT point Opera to it. He failed to show them an actual hole, and ignored requests for more information.
Note how all information so far indicates that it wasn't actually exploitable until recent versions, which is even more damning for this guy.
False. It is not Opera's fault that the guy refused to give them more information.
The hole was apparently NOT there for the past six months.
Stop lying. No one needs to force Opera to fix anything.
ChirpieWednesday, October 19, 2011 2:37:22 PM
Originally posted by grogge:
It has NOT been known to opera for half a year. It was not reproducible in the final version at the time, so the guy adapted the exploit and made it work in the most recent version instead.That means it's a NEW and DIFFERENT exploit, so he's lying.
It was. They couldn't reproduce it in the stable version at the time, and the reporter refused to give them more details.
Except this is not what happened.
This vulnerability was fixed less than a week after it was actually reported to Opera.
Go away, troll.
adamreicholdWednesday, October 19, 2011 2:47:12 PM
- While scrolling, the main menu pops up spontaneously but repeatedly for no reason whatsoever.
- When switching workspaces, sometimes the current tab is unresponsive (i.e. does react to clicks or keys at all) until I switch to another tab and back.
To me, both seem to be related to window manager interaction? I still have to do more testing to check the level of reproducibility...