Bug 568181 – CVE-2010-0650 webkit: remote bypass of popup window block settings

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 568181 - (CVE-2010-0650) CVE-2010-0650 webkit: remote bypass of popup window block settings

Summary:	CVE-2010-0650 webkit: remote bypass of popup window block settings

Status:	CLOSED NOTABUG

Aliases:	CVE-2010-0650

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:	http://web.nvd.nist.gov/view/vuln/det...
Whiteboard:	impact=low,source=cve,reported=201002...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2010-02-24 17:54 EST by Vincent Danen
Modified:	2010-04-30 11:15 EDT (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2010-04-30 09:39:18 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Vincent Danen 2010-02-24 17:54:20 EST

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-0650 to
the following vulnerability:

WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event.

http://code.google.com/p/chromium/issues/detail?id=3275
http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
https://bugs.webkit.org/show_bug.cgi?id=21501
http://securitytracker.com/id?1023506

Comment 1 Jaroslav Reznik 2010-02-25 10:38:03 EST

I can't reproduce in Arora - QtWebKit based (with Qt 4.6.1) with popup windows blocker enabled. With disabled it works as expected - new tab is opened.

Comment 2 Tomas Hoger 2010-04-30 09:39:18 EDT

I've tested couple of browsers in Fedora using webkitgtk or qtwebkit.  I was only able to get a popup using the test case from google bug with arora with popup blocking disabled (as mentioned in comment #1).  Other browsers either don't seem to handle popups or block them and don't offer a way to disable blocking.

Comment 4 Vincent Danen 2010-04-30 11:15:22 EDT

The upstream changeset to correct this is here:

http://trac.webkit.org/changeset/49827

Note You need to log in before you can comment on or make changes to this bug.