CVE-2010-1389

Vulnerability

A cross-site scripting (XSS) vulnerability exists in WebKit as used in Apple Safari before version 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before version 4.1 on Mac OS X 10.4 [2]. The flaw is triggered when a user performs a paste or drag-and-drop operation for a selected portion of a page, while visiting a malicious website. No special configuration is required beyond using an affected browser version.

Exploitation

An attacker must first trick the victim into visiting a crafted web page and persuade them to either paste or drag-and-drop a selection. Since the attack relies on user interaction (a paste or drag–and–drop action), it is considered user-assisted [1][2]. No authentication or special network position is required beyond serving the malicious content.

Impact

Successful exploitation allows a remote attacker to inject arbitrary web script or HTML into the context of the victim's browser. This can lead to disclosure of sensitive information, session hijacking, or other actions achievable through injected script, all within the security context of the target site [2].

Mitigation

Apple addressed this vulnerability in Safari 5.0 and Safari 4.1 [2]. Users should update to Safari 5.0 (or later) on Mac OS X 10.5–10.6 and Windows, or to Safari 4.1 on Mac OS X 10.4. Linux users of WebKit-based browsers can refer to Ubuntu advisory USN-1006-1 for the corresponding fixes [4]. No workaround is available; applying the security update is the recommended mitigation.