Secunia

A vulnerability exists in the way the Opera browser generates a temporary page for displaying a redirection, when "Automatic redirection" is disabled (not default setting).

When Opera generates a page for displaying a redirect, it does not strip any characters, making it possible to inject malicious script code into the page generated by the Opera browser. This page has the same privileges as the domain trying to redirect the user, making it possible to steal cookies, hi-jack sessions etc. from the domain.

Eg. many websites use a "redirect-script" to redirect users. These scripts often take arguments without any further validation, because their only function is to send the user to a new URL. However when
Opera is set to not automatically redirect a user, Opera will display this URL on a temporary page without stripping it for malicious code.

Sample exploit:
http://secunia.com/secunia_research/2003-1/exploit/

Following have been tested and found vulnerable:
Opera prior to 7.02 on Windows
Opera 6.x on both Windows and Linux
Opera 7.02 "Bork Edition" is also vulnerable.

Solution
Vendor patch:
Further details available in Customer Area

Provided and/or discovered by
Jakob Balle, Secunia

Changelog
Further details available in Customer Area

Original Advisory
http://secunia.com/secunia_research/2003-1/

Deep Links
Links available in Customer Area