Vulnerabilities > CVE-2010-3254 - Integer Overflow OR Wraparound vulnerability in Google Chrome

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
google
CWE-190
critical
nessus

Summary

The WebSockets implementation in Google Chrome before 6.0.472.53 does not properly handle integer values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Vulnerable Configurations

Part Description Count
Application
Google
677

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1195-1.NASL
    descriptionA large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id55967
    published2011-08-24
    reporterUbuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55967
    titleUbuntu 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1195-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1195-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(55967);
      script_version("1.12");
      script_cvs_date("Date: 2019/09/19 12:54:27");
    
      script_cve_id("CVE-2010-1824", "CVE-2010-2646", "CVE-2010-2651", "CVE-2010-2900", "CVE-2010-2901", "CVE-2010-3120", "CVE-2010-3254", "CVE-2010-3812", "CVE-2010-3813", "CVE-2010-4040", "CVE-2010-4042", "CVE-2010-4197", "CVE-2010-4198", "CVE-2010-4199", "CVE-2010-4204", "CVE-2010-4206", "CVE-2010-4492", "CVE-2010-4493", "CVE-2010-4577", "CVE-2010-4578", "CVE-2011-0482", "CVE-2011-0778");
      script_bugtraq_id(41976, 44241, 44646, 44954, 44960, 45170, 45390, 45718, 45719, 45720, 45721, 45722, 45788, 46144, 46677);
      script_xref(name:"USN", value:"1195-1");
    
      script_name(english:"Ubuntu 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1195-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A large number of security issues were discovered in the WebKit
    browser and JavaScript engines. If a user were tricked into viewing a
    malicious website, a remote attacker could exploit a variety of issues
    related to web browser security, including cross-site scripting
    attacks, denial of service attacks, and arbitrary code execution.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1195-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libwebkit-1.0-2 package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libwebkit-1.0-2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/07/06");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/08/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/08/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|10\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 10.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"libwebkit-1.0-2", pkgver:"1.2.7-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"10.10", pkgname:"libwebkit-1.0-2", pkgver:"1.2.7-0ubuntu0.10.10.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libwebkit-1.0-2");
    }
    
  • NASL familyWindows
    NASL idGOOGLE_CHROME_6_0_472_53.NASL
    descriptionThe version of Google Chrome installed on the remote host is earlier than 6.0.472.53. It therefore is reportedly affected by multiple vulnerabilities : - It is possible to bypass the pop-up blocker with a blank frame target . (Issue #34414) - It is possible to visually spoof the URL bar with homographic sequences. (Issue #37201) - Restrictions on setting clipboard content are not strict enough. (Issue #41654) - A stale pointer exists with SVG filters. (Issue #45659) - It may be possible to enumerate installed extensions. (Issue #45876) - An unspecified vulnerability in WebSockets could lead to a browser NULL crash. (Issue #46750, #51846) - A use-after-free error exists in the Notifications presenter. (Issue #50386) - An unspecified memory corruption issue exists in Notification permissions. (Issue #50839) - Multiple unspecified integer errors exist in WebSockets. (Issue #51360, #51739) - A memory corruption issue exists with counter nodes. (Issue #51653) - Chrome may store an excessive amount of autocomplete entries. (Issue #51727) - A stale pointer exists in focus handling. (Issue #52443) - A Sandbox parameter deserialization error exists. (Issue #52682) - An unspecified cross-origin image theft issue exists. (Issue #53001)
    last seen2020-06-01
    modified2020-06-02
    plugin id49089
    published2010-09-02
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49089
    titleGoogle Chrome < 6.0.472.53 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(49089);
      script_version("1.18");
      script_cvs_date("Date: 2018/11/15 20:50:27");
    
      script_cve_id(
        "CVE-2010-3246",
        "CVE-2010-3247",
        "CVE-2010-3248",
        "CVE-2010-3249",
        "CVE-2010-3250",
        "CVE-2010-3251",
        "CVE-2010-3252",
        "CVE-2010-3253",
        "CVE-2010-3254",
        "CVE-2010-3255",
        "CVE-2010-3256",
        "CVE-2010-3257",
        "CVE-2010-3258",
        "CVE-2010-3259"
      );
      script_bugtraq_id(42952, 44204, 44206, 44216);
    
      script_name(english:"Google Chrome < 6.0.472.53 Multiple Vulnerabilities");
      script_summary(english:"Checks version number of Google Chrome");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host contains a web browser that is affected by multiple
    vulnerabilities.");
    
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote host is earlier
    than 6.0.472.53.  It therefore is reportedly affected by multiple
    vulnerabilities :
    
      - It is possible to bypass the pop-up blocker with a blank
        frame target . (Issue #34414)
    
      - It is possible to visually spoof the URL bar with
        homographic sequences. (Issue #37201)
    
      - Restrictions on setting clipboard content are not strict
        enough. (Issue #41654)
    
      - A stale pointer exists with SVG filters. (Issue #45659)
    
      - It may be possible to enumerate installed extensions.
        (Issue #45876)
    
      - An unspecified vulnerability in WebSockets could lead
        to a browser NULL crash. (Issue #46750, #51846)
    
      - A use-after-free error exists in the Notifications
        presenter. (Issue #50386)
    
      - An unspecified memory corruption issue exists in
        Notification permissions. (Issue #50839)
    
      - Multiple unspecified integer errors exist in WebSockets.
        (Issue #51360, #51739)
    
      - A memory corruption issue exists with counter nodes.
        (Issue #51653)
    
      - Chrome may store an excessive amount of autocomplete
        entries. (Issue #51727)
    
      - A stale pointer exists in focus handling. (Issue #52443)
    
      - A Sandbox parameter deserialization error exists.
        (Issue #52682)
    
      - An unspecified cross-origin image theft issue exists.
        (Issue #53001)");
    
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?99f0b3fb");
      script_set_attribute(attribute:"solution", value:"Upgrade to Google Chrome 6.0.472.53 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/09/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/09/02");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");
    
      script_dependencies("google_chrome_installed.nasl");
      script_require_keys("SMB/Google_Chrome/Installed");
    
      exit(0);
    }
    
    include("google_chrome_version.inc");
    
    get_kb_item_or_exit("SMB/Google_Chrome/Installed");
    
    installs = get_kb_list("SMB/Google_Chrome/*");
    google_chrome_check_version(installs:installs, fix:'6.0.472.53', severity:SECURITY_HOLE);
    

Oval

accepted2013-08-12T04:01:03.342-04:00
classvulnerability
contributors
  • nameJ. Daniel Brown
    organizationDTCC
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
definition_extensions
commentGoogle Chrome is installed
ovaloval:org.mitre.oval:def:11914
descriptionThe WebSockets implementation in Google Chrome before 6.0.472.53 does not properly handle integer values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
familywindows
idoval:org.mitre.oval:def:12119
statusaccepted
submitted2010-09-12T17:30:00.000-05:00
titleGoogle Chrome WebSockets Implementation Integer Handling Unspecified Remote DoS
version51