WebKit Frame Transition Cross Domain Scripting Vulnerability

Bugtraq ID:	35328
Class:	Access Validation Error
CVE:	CVE-2009-1695
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	Dec 14 2009 08:54PM
Credit:	Feng Qian of Google Inc. <br>
Vulnerable:	WebKit Open Source Project WebKit 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Apple Safari For Windows 3.2.1 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 Apple Safari 1.3.2 Apple Safari 1.3.1 + Apple Mac OS X 10.3.9 Apple Safari 1.3 + Apple Mac OS X 10.3.9 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.3.7 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari 1.1 Apple Safari 1.0 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari Beta 2 Apple Safari 4 Beta Apple Safari 4 Beta Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1
Not Vulnerable:	Apple Safari 4 for Windows Apple Safari 4 Apple iPod Touch 3.0 Apple iPhone 3.0

WebKit Frame Transition Cross Domain Scripting Vulnerability

WebKit is prone to a cross-domain scripting vulnerability.

An attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or to launch spoofing attacks against other sites. Other attacks are also possible.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

WebKit Frame Transition Cross Domain Scripting Vulnerability

To exploit some of these issues, an attacker must entice a victim into visiting a malicious page.

WebKit Frame Transition Cross Domain Scripting Vulnerability

Solution:
Vendor fixes are available. Please see the referenced advisory for details.


Debian Linux 5.0 ia-64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 alpha

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 mipsel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 4 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 armel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_armel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_armel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 4 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 mips

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mips.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mips.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 sparc

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 ia-32

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_i386.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_i386.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 s/390

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_s390.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_s390.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 hppa

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 m68k

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 arm

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_arm.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_arm.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 amd64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari Beta 2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 powerpc

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 1.0

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.4

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  For Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  For Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta for Windows

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

WebKit Frame Transition Cross Domain Scripting Vulnerability

References:

• About the security content of iPhone OS 3.0 Software Update (Apple)
  
• Apple Safari Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)