WebKit Subframe Click Jacking Vulnerability

Bugtraq ID:	35317
Class:	Unknown
CVE:	CVE-2009-1681
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	May 12 2015 07:48PM
Credit:	Apple
Vulnerable:	WebKit Open Source Project WebKit 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Apple Safari For Windows 3.2.1 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 Apple Safari 1.3.2 Apple Safari 1.3.1 + Apple Mac OS X 10.3.9 Apple Safari 1.3 + Apple Mac OS X 10.3.9 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.3.7 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari 1.1 Apple Safari 1.0 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari Beta 2 Apple Safari 4 Beta Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1
Not Vulnerable:	Apple Safari 4 for Windows Apple Safari 4

WebKit Subframe Click Jacking Vulnerability

WebKit is prone to a click-jacking vulnerability.

Attackers may exploit this issue to execute arbitrary code, launch cross-site scripting attacks, elevate privileges, or obtain sensitive information. Other attacks are also possible.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security
Vulnerabilities), but has been assigned its own record to better document it.

WebKit Subframe Click Jacking Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to view a malicious webpage.

WebKit Subframe Click Jacking Vulnerability

Solution:
Vendor fixes are available. Please see the referenced advisory for details.


Debian Linux 5.0 ia-64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 alpha

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 mipsel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 armel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_armel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_armel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 4 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 mips

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mips.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mips.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 sparc

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 ia-32

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_i386.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_i386.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 s/390

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_s390.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_s390.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 hppa

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 m68k

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 arm

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_arm.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_arm.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 amd64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari Beta 2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 powerpc

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 1.0

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.4

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  For Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  For Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta for Windows

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

WebKit Subframe Click Jacking Vulnerability

References:

• Apple Safari Homepage (Apple)