Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140304100301.7d7fa1a8@hboeck.de>
Date: Tue, 4 Mar 2014 10:03:01 +0100
From: Hanno Böck <hanno@...eck.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE request: konqueror not providing any protection against
 clickjacking

Hi,

It may be debatable if that's a CVE issue, because it's basically a
"there's a general vulnerability in the way HTML/JS is done, there's a
protection mechanism and product X doesn't have it". I think it
deserves one and as recently Konqueror issues popped up here I thought
it might deserve a CVE:
https://bugs.kde.org/show_bug.cgi?id=259070

Basically, pretty much all mainstream browsers support the
X-Frame-Options header to allow web developers to secure their apps
from clickjacking attacks. Konqueror doesn't support it.

Please assign CVE.

(and if curious: I've setup a test for X-FRAME-OPTIONS header
functionality a while ago http://int21.de/frametest/ )

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: BBB51E42

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.