CVE ID:	CVE-2010-3813
Description:	The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products does not verify whether DNS prefetching is enabled when processing an HTML LINK element, which allows remote attackers to bypass intended access restrictions, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality.
Test IDs:	1.3.6.1.4.1.25623.1.0.68823   1.3.6.1.4.1.25623.1.0.68773
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3813 http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 http://trac.webkit.org/changeset/63622 https://bugs.webkit.org/show_bug.cgi?id=42500 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12293 RedHat Security Advisories: RHSA-2011:0177 http://www.redhat.com/support/errata/RHSA-2011-0177.html http://secunia.com/advisories/42314 http://secunia.com/advisories/43068 http://secunia.com/advisories/43086 SuSE Security Announcement: SUSE-SR:2011:002 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://www.vupen.com/english/advisories/2010/3046 http://www.vupen.com/english/advisories/2011/0212 http://www.vupen.com/english/advisories/2011/0216 http://www.vupen.com/english/advisories/2011/0552