Bug 577583 (CVE-2010-1126) - CVE-2010-1126 webkit: keystrokes sent to hidden frame rather than visible frame due to javascript flaw
Summary: CVE-2010-1126 webkit: keystrokes sent to hidden frame rather than visible fra...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-1126
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://web.nvd.nist.gov/view/vuln/det...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-03-28 03:44 UTC by Vincent Danen
Modified: 2019-09-29 12:35 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-05-25 16:01:06 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2010-03-28 03:44:57 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1126 to
the following vulnerability:

Name: CVE-2010-1126
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1126
Assigned: 20100326
Reference: BUGTRAQ:20100313 ...because you can't get enough of clickjacking
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/510070/100/0/threaded

The JavaScript implementation in WebKit allows remote attackers to
send selected keystrokes to a form field in a hidden frame, instead of
the intended form field in a visible frame, via certain calls to the
focus method.
Comment 1 Tomas Hoger 2010-05-25 16:01:06 UTC 
Direct link to Michal Zalewski's demo:
  http://lcamtuf.coredump.cx/focus-webkit/

Closing this notabug, as the issue can't be reproduced with current webkitgtk / qtwebkit browsers in RHEL / Fedora.
Note You need to log in before you can comment on or make changes to this bug.