BID:40669

Webkit UTF-7 Cross-Site Scripting Vulnerability

Info

Webkit UTF-7 Cross-Site Scripting Vulnerability

Bugtraq ID:	40669
Class:	Input Validation Error
CVE:	CVE-2010-1390
Remote:	Yes
Local:	No
Published:	Jun 07 2010 12:00AM
Updated:	Mar 02 2011 03:58PM
Credit:	Masahiro Yamada
Vulnerable:	WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 MandrakeSoft Linux Mandrake 2010.1 x86_64 MandrakeSoft Linux Mandrake 2010.1 Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.1 Apple iTunes 8.2 Apple iTunes 8.1 Apple iTunes 8.0.2.20 Apple iTunes 8.0 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0

Not Vulnerable:	WebKit Open Source Project WebKit 1.2.5 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1 Apple iTunes 9.2 Apple iOS 4

Discussion

Webkit UTF-7 Cross-Site Scripting Vulnerability

Webkit is prone to a cross-site scripting vulnerability.

The attacker may leverage this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

NOTE: This issue was previously covered in BID 40620 (Apple Safari Prior to 5.0 and 4.1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it.

Exploit / POC

Webkit UTF-7 Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Solution / Fix

Webkit UTF-7 Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apple Safari 4

Apple Safari5.0SnowLeopard.dmg
http://www.apple.com/safari/download/

Apple Safari5.0Leopard.dmg
http://www.apple.com/safari/download/

Apple Safari4.1Tiger.dmg
http://www.apple.com/safari/download/

Ubuntu Ubuntu Linux 9.10 sparc

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_sparc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_sparc.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_sparc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_sparc.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_sparc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_sparc.deb

Apple Safari 4 for Windows

Apple Safari_Setup-safari5.exe
http://www.apple.com/safari/download/

Apple SafariQuickTimeSetup-safari5.exe
http://www.apple.com/safari/download/

Apple SafariSetup-safari5.exe
http://www.apple.com/safari/download/

Ubuntu Ubuntu Linux 9.10 powerpc

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_powerpc.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_powerpc.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_powerpc.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb

Ubuntu Ubuntu Linux 9.10 lpia

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_lpia.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_lpia.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_lpia.deb

MandrakeSoft Linux Mandrake 2010.1 x86_64

Mandriva lib64webkitgtk1.0-devel-1.2.7-0.1mdv2010.2.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva webkit-jsc-1.2.7-0.1mdv2010.2.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva webkit-gtklauncher-1.2.7-0.1mdv2010.2.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva webkit1.0-1.2.7-0.1mdv2010.2.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva lib64webkitgtk1.0_2-1.2.7-0.1mdv2010.2.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva webkit-1.2.7-0.1mdv2010.2.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva webkit1.0-webinspector-1.2.7-0.1mdv2010.2.x86_64.rpm
http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.10 amd64

Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.10.1_amd64.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.10.1_amd64.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.10.1_amd64.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.10.1_amd64.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb

Ubuntu Ubuntu Linux 10.04 powerpc

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb

Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.04.1_powerpc.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.04.1_powerpc.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.04.1_powerpc.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.04.1_powerpc.deb

MandrakeSoft Linux Mandrake 2010.1

Mandriva webkit1.0-webinspector-1.2.7-0.1mdv2010.2.i586.rpm
http://www.mandriva.com/en/download/

Mandriva webkit-jsc-1.2.7-0.1mdv2010.2.i586.rpm
http://www.mandriva.com/en/download/

Mandriva libwebkitgtk1.0-devel-1.2.7-0.1mdv2010.2.i586.rpm
http://www.mandriva.com/en/download/

Mandriva webkit-1.2.7-0.1mdv2010.2.i586.rpm
http://www.mandriva.com/en/download/

Mandriva webkit1.0-1.2.7-0.1mdv2010.2.i586.rpm
http://www.mandriva.com/en/download/

Mandriva libwebkitgtk1.0_2-1.2.7-0.1mdv2010.2.i586.rpm
http://www.mandriva.com/en/download/

Mandriva webkit-gtklauncher-1.2.7-0.1mdv2010.2.i586.rpm
http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 i386

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.9.10.1_i386.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.9.10.1_i386.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.9.10.1_i386.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb

Ubuntu Ubuntu Linux 10.10 powerpc

Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.10.1_powerpc.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.10.1_powerpc.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.10.1_powerpc.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.10.1_powerpc.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb

Ubuntu Ubuntu Linux 10.04 amd64

Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.04.1_amd64.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.04.1_amd64.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.04.1_amd64.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.04.1_amd64.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb

Ubuntu Ubuntu Linux 9.10 amd64

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.9.10.1_amd64.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.9.10.1_amd64.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.9.10.1_amd64.deb

Ubuntu Ubuntu Linux 10.10 i386

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.10.1_i386.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.10.1_i386.deb

Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.10.1_i386.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.10.1_i386.deb

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb

Ubuntu Ubuntu Linux 10.04 sparc

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_sparc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.04.1_sparc.deb

Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_sparc.deb
http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.04.1_sparc.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_sparc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.04.1_sparc.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_sparc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.04.1_sparc.deb

Apple iTunes 9.1

Apple iTunes9.2.dmg
for Mac OS X
http://www.apple.com/itunes/download/

Apple APPLE-SA-2010-06-16-1-iTunesSetup.exe
For Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/

Apple APPLE-SA-2010-06-16-1-iTunes64Setup.exe
For 64-bit Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/

Ubuntu Ubuntu Linux 10.04 i386

Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb

Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.04.1_i386.deb

Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.04.1_i386.deb

Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.04.1_i386.deb

Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.04.1_i386.deb

Webkit UTF-7 Cross-Site Scripting Vulnerability

BID:40669

Info

Discussion

Exploit / POC

Solution / Fix

References