Vulnerabilities > CVE-2010-0657 - Unspecified vulnerability in Google Chrome

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
google
microsoft
critical
nessus
NVD
Published: 2010-02-18
Updated: 2017-09-19

Summary

Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut. Per: http://cwe.mitre.org/data/slices/2000.html 'Improper Encoding or Escaping of Output CWE-116'

Vulnerable Configurations

Part Description Count
Application
Google
47
OS
Microsoft
1

Nessus

NASL familyWindows
NASL idGOOGLE_CHROME_4_0_249_78.NASL
descriptionThe version of Google Chrome installed on the remote host is earlier than 4.0.249.78. Such versions are reportedly affected by multiple vulnerabilities : - A pop-up blocker bypass. (Issue #3275) - Cross-domain theft due to CSS design error. (Issue #9877) - Browser memory error with stale pop-up block menu. (Issue #12523) - An unspecified error allows XMLHttpRequests to directories. (Issue #20450) - An unspecified error exists related to escaping characters in shortcuts. (Issue #23693) - Renderer memory errors exist when drawing on canvases. (Issue #8864, #24701, #24646) - An image decoding memory error. (Issue #28566) - An unspecified error exists that could result in failure to strip
last seen2020-06-01
modified2020-06-02
plugin id44317
published2010-01-26
reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/44317
titleGoogle Chrome < 4.0.249.78 Multiple Vulnerabilities

Oval

accepted2014-04-07T04:01:05.331-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationDTCC
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
descriptionGoogle Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
familywindows
idoval:org.mitre.oval:def:14306
statusaccepted
submitted2011-11-25T18:05:42.000-05:00
titleGoogle Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
version52

References