WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing Vulnerability

Bugtraq ID:	35340
Class:	Unknown
CVE:	CVE-2009-1710
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	Dec 14 2009 08:54PM
Credit:	Dean McNamee of Google
Vulnerable:	WebKit Open Source Project WebKit 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Apple Safari For Windows 3.2.1 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 Apple Safari 1.3.2 Apple Safari 1.3.1 + Apple Mac OS X 10.3.9 Apple Safari 1.3 + Apple Mac OS X 10.3.9 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.3.7 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari 1.1 Apple Safari 1.0 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari Beta 2 Apple Safari 4 Beta Apple Safari 4 Beta Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3
Not Vulnerable:	Apple Safari 4 for Windows Apple Safari 4

WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing Vulnerability

WebKit is prone to a vulnerability that may allow attackers to spoof browser UI elements.

If an attacker can spoof certain UI elements, then this may lead to a false sense of trust if the user is presented with spoofed UI elements when interacting with a malicious site.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security
Vulnerabilities), but has been assigned its own record to better document it.

WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing Vulnerability

Solution:
Vendor fixes are available. Please see the referenced advisory for details.


Apple Safari 3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 ia-64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 alpha

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 ia-32

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_i386.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_i386.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 s/390

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_s390.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_s390.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 mipsel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 4 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 hppa

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 m68k

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 arm

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_arm.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_arm.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 armel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_armel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_armel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 4 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 amd64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari Beta 2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 mips

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mips.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mips.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 powerpc

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 sparc

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 1.0

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.4

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  For Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  For Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta for Windows

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing Vulnerability

References:

• Apple Safari Homepage (Apple)
  
• WebKit Homepage (WebKit Open Source Project)