-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FLOCK-SA-2010-04 http://flock.com/security/ Title: window.open() Method Javascript Same-Origin Policy Violation (XSS) Impact: High Announced on: 2010-09-09 Affected Products: Flock 3 versions prior to 3.0.0.4094 CVEs (cve.mitre.org): CVE-2010-0661 Details: WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method. Credit to Tokuji Akamine, Senior Consultant at Symantec Consulting Services (for Chromium) and Lostmon Lords (for Flock). References: https://bugs.webkit.org/show_bug.cgi?id=32647 http://code.google.com/p/chromium/issues/detail?id=30660 -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJMj6tpAAoJEPzFtDWO6ceqVloP/19NsAyXYRvtQABv7ztHyOxd bGdsp0FMVp/fMbpDIwzStHbfnlYnFqDAzWb6Zy64jKuFzK8mKXYcoAqbz3EoX3Ux Y0IUyKDdfR1HvnttXRYnAw7M4UKN54MYLAOD80j8ztjt1sjMluWPUxlKSewR8SfM pnIxID3nD7R9DmhABtDKOnTCfrHBgHnKbl1/nMcyUj+x0MtCNktddcYLO3dtaop+ 8FdbKNyFkrKLjqyNqIIa0FNBk4VgDfggLRPHC3PpfBLTcxlXr1/kDLnzIP7PPBuM HpaM/IO/RotzBIDEvJR3tN9YnoTXxR++ExPg0nZuAi3CUS0Jr2jfrarkfs5VzZOs J4WbCWilqccwqzanNdBu6FncYn3R9IytpZiCznO/mpek4lIV6fZlx6LnX9ZFFWsL ExWZ7jqNPj81mifDVuTeMa0BkZ2SvFhOXU1kUmfZvb+/Bu5oQ5hhX5Cpkb0EXBz0 CkNLC7tIq5O4Szczrlt0jb5XiRvhAocinq3yDdPnK9zHKHf+ia1BWt86kxf+fxXJ kQA8hl8fUgN53uoxs6BrQCjo8HrrMxDXojNOtcrw5U7XOWMHm9P0kbJd4PXGjb+c NMSoAoXnXXwm5QKURVxbApZ8vvJiB2LQRvj5A1OMcbYkAUlhS6CJbh0cAET4AutW VugAZ6Q8Wnrk5d6Eoqbc =FVwj -----END PGP SIGNATURE-----
