Bug 445357 - (CVE-2008-1999) CVE-2008-1999 WebKit: address bar spoofing using URLs with spaces
CVE-2008-1999 WebKit: address bar spoofing using URLs with spaces
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://nvd.nist.gov/nvd.cfm?cvename=C...
impact=moderate,reported=20080428,pub...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-05-06 10:02 EDT by Tomas Hoger
Modified: 2011-02-05 05:18 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-02-05 04:54:22 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2008-05-06 10:02:12 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1999 to the following vulnerability:

Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL (aka the user field), as demonstrated by %E3%80%80 sequences.

Refences:
http://www.securityfocus.com/archive/1/archive/1/491192/100/0/threaded
http://es.geocities.com/jplopezy/pruebasafari3.html
http://www.frsirt.com/english/advisories/2008/1347
http://secunia.com/advisories/29900
http://xforce.iss.net/xforce/xfdb/41981
Comment 1 Tomas Hoger 2008-05-06 10:12:28 EDT
Even though this CVE is worded as affecting Apple Safari, this issue is probably
in WebKit.  Test case causes both kazehakase(-webkit) and midori to display
spoofed URL as:

attacker_controlled_prefix<spaces ... spaces>@real_url

Depending on the with of your browser window, you may only see
attacker_controlled_prefix part of the URL, which may trick you to believe you
are currently visiting different site.

If you switch kazehakase to use gecko, it will:
- warn you that you are trying to log to a site that does not require
  authentication
- display %-encoded sequence in address bar
(same behavior as you get with e.g. firefox)

I haven't checked WebKit SVN whether there is any fix for this already.

Tested with: WebKit-gtk-1.0.0-0.8.svn32416
Comment 2 Mamoru TASAKA 2008-05-07 03:18:11 EDT
r32901 seems no good (however would you check it?)
http://koji.fedoraproject.org/koji/taskinfo?taskID=597635
Comment 3 Tomas Hoger 2008-05-16 15:20:14 EDT
Yes, r32901 / WebKit-1.0.0-0.9.svn32901 still affected.
Comment 4 Tomas Hoger 2008-07-25 06:14:55 EDT
No change with WebKit-1.0.0-0.10.svn34655
Comment 5 Vincent Danen 2010-12-23 13:09:30 EST
The geocities page with the proof of concept is gone.  I can't find any reference that this was fixed, but considering how old this is and that we currently have webkitgtk 1.2.x, I imagine this is fixed, but can't verify.  Does someone have a local copy of this PoC?  I also can't find anything in the upstream webkit bts so no idea if this has been addressed or not.
Comment 6 Huzaifa S. Sidhpurwala 2011-02-05 04:54:22 EST
There is nothing webkit can do in here. URL handling is handled by the browser layer.

Note You need to log in before you can comment on or make changes to this bug.