Bug 568181 (CVE-2010-0650)

Summary:	CVE-2010-0650 webkit: remote bypass of popup window block settings
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jreznik, peter
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0650
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-04-30 13:39:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2010-02-24 22:54:20 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-0650 to
the following vulnerability:

WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event.

http://code.google.com/p/chromium/issues/detail?id=3275
http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
https://bugs.webkit.org/show_bug.cgi?id=21501
http://securitytracker.com/id?1023506

Comment 1 Jaroslav Reznik 2010-02-25 15:38:03 UTC

I can't reproduce in Arora - QtWebKit based (with Qt 4.6.1) with popup windows blocker enabled. With disabled it works as expected - new tab is opened.

Comment 2 Tomas Hoger 2010-04-30 13:39:18 UTC

I've tested couple of browsers in Fedora using webkitgtk or qtwebkit.  I was only able to get a popup using the test case from google bug with arora with popup blocking disabled (as mentioned in comment #1).  Other browsers either don't seem to handle popups or block them and don't offer a way to disable blocking.

Comment 4 Vincent Danen 2010-04-30 15:15:22 UTC

The upstream changeset to correct this is here:

http://trac.webkit.org/changeset/49827