CVE-2016-6908 Information

Description

Characters from languages are such as Arabic Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android due to mishandling of several unicode characters such as U+FE70 U+0622 U+0623 etc and how they are rendered combined with (first strong character) such as an IP address or alphabet could lead to a spoofed URL. It was noticed that by placing neutral characters such as /\ ?\ in filepath causes the URL to be flipped and displayed from Right To Left. However in order for the URL to be spoofed the URL must begin with an IP address followed by neutral characters as omnibox considers IP address to be combination of punctuation and numbers and since LTR (Left To Right) direction is not properly enforced this causes the entire URL to be treated and rendered from RTL (Right To Left). However it doesn’t have be an IP address what matters is that first strong character (generally alphabetic character) in the URL must be an RTL character.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

http://www.securityfocus.com/bid/92701

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1