Vulnerabilities > CVE-2010-0664 - Resource Management Errors vulnerability in Google Chrome
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
| NASL family | Windows |
| NASL id | GOOGLE_CHROME_4_0_249_78.NASL |
| description | The version of Google Chrome installed on the remote host is earlier than 4.0.249.78. Such versions are reportedly affected by multiple vulnerabilities : - A pop-up blocker bypass. (Issue #3275) - Cross-domain theft due to CSS design error. (Issue #9877) - Browser memory error with stale pop-up block menu. (Issue #12523) - An unspecified error allows XMLHttpRequests to directories. (Issue #20450) - An unspecified error exists related to escaping characters in shortcuts. (Issue #23693) - Renderer memory errors exist when drawing on canvases. (Issue #8864, #24701, #24646) - An image decoding memory error. (Issue #28566) - An unspecified error exists that could result in failure to strip |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 44317 |
| published | 2010-01-26 |
| reporter | This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/44317 |
| title | Google Chrome < 4.0.249.78 Multiple Vulnerabilities |
Oval
| accepted | 2014-04-07T04:00:44.181-04:00 | ||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||
| description | Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring. | ||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:14097 | ||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||
| submitted | 2011-11-25T18:05:54.000-05:00 | ||||||||||||||||||||||||||||
| title | Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring. | ||||||||||||||||||||||||||||
| version | 52 |
References
- http://code.google.com/p/chromium/issues/detail?id=31517
- http://exchange.kg/other/chrome3_0day-denial_of_service_crash.html
- http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
- http://securitytracker.com/id?1023506
- http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
- http://twitter.com/akirsanov/statuses/7370288490
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14097