bugtraq - File downloads in Opera at known locations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 29 Jul 2004 11:38:31 +0530
From: "Rohit Dube" <rohit@...tikalsolutions.com>
To: <bugtraq@...urityfocus.com>
Subject: File downloads in Opera at known locations

Hi,
 This is just a question. While using opera, I observed that as soon as it
prompts you for file download, it simultaneously starts the download with
same file extension in its %USERPROFILE/application data/opera/cache. Even
if the user afterwards chooses cancel, this temporary file does not get
deleted. So if the file size was very small, it will get downloaded
completely. Reported this to opera and they are convinced this is not a
problem (bugid 148412). They do not have problems such as directory
traversal causing file dropping in user startup etc. 
Is this a problem? Can this be used in conjunction with some other
vulnerability to get access to the system?

Thanx
Rohit Dube

----The reader this message encounters not failing to understand is
cursed.----