aspro said:

Yoda, Love to hear you chime in on the Opera security issue that came up last week.  Is it an Opera problem or a Windows problem? (it's probably not that clean cut).

http://www.pcworld.com/article/191061/opera_to_patch_browser_vulnerability_soon.html

It's definitely an Opera issue.  It's a buffer overflow in the HTTP header information, specifically the content-length attribute; that's part of every client-server transaction.  The recommendations of enabling DEP and ASLR are really stupid suggestions, because that applies for pretty much every buffer or stack overflow because it's to make remote code execution in RAM more difficult.  It doesn't address the problem of this exploit specifically at all.  You should just have those enabled, anyway.

It's unclear whether or not this affects all platforms, as Opera is closed source and I haven't heard any specifics otherwise.  The same applies for previous versions.  This is not something that you'd expect to be receiving a great deal of changes and updates over time, so this has likely just been sitting there for a long, long time.  I'd say it's likely cross-platform.

I'm a bit unnerved that there hasn't been an update to Opera, yet.  I don't know the code, but it's from reports a straight overflow on a single value, so it ought to be a simple fix.  Normally Opera has quite good security practices.

The topic isn't one I've looked in great detail, so I'm just taking the sources for their word, but this is a really ugly situation.  You can't look at browsers quite in the same light as operating systems in terms of likelihood of exploitation, because it's common for attackers to send malware in bunches just to see what works.  This should be a pathetically easy exploit, so despite Opera's 1-2% marketshare, I can't imagine it not quickly making its way into these malware packages.

I'm still using Opera because I'm on Linux, and frankly I don't exactly tend to stray into the dark areas of the net very often.  If I were in Windows, for my typical browsing I still wouldn't really feel too concerned, but it would make me uneasy to use until updating, kind of like every time I have to use IE.

EDIT: You can get Opera 10.51 Release Candidate 3 for Windows here which includes a fix for the problem.

aspro said:

I'm about to listen to Security Now, where Steve will talk about it.  It is puzzling why they still have not patched it.  Thanks for your response.

It looks like they have updated it, but they're including it with some other updates in 10.51 (rather than pushing out the update immediately as 10.51 and previously planned updates as 10.52), so they're not done testing before pushing out the update.

Foolz said:

"to simple Google your way to."

*Too simple to google your way to.

I believe what he tried to say is "to simply Google your way to".

SteelAttack said:

Foolz said:

"to simple Google your way to."

*Too simple to google your way to.

I believe what he tried to say is "to simply Google your way to".

Ah, that'd be much simply---I mean simpler.

Still a mistake, though! Feel the burn.