Vulnerabilities > CVE-2010-3730 - Unspecified vulnerability in Google Chrome

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
google
nessus

Summary

Google Chrome before 6.0.472.62 does not properly use information about the origin of a document to manage properties, which allows remote attackers to have an unspecified impact via a crafted web site, related to a "property pollution" issue.

Vulnerable Configurations

Part Description Count
Application
Google
687

Nessus

NASL familyWindows
NASL idGOOGLE_CHROME_6_0_472_62.NASL
descriptionThe version of Google Chrome installed on the remote host is earlier than 6.0.472.62. Such versions are reportedly affected by multiple vulnerabilities : - There is a bad cast with malformed SVGs. (Issue #55114) - The buffer is mismanaged in the SPDY protocol. (Issue #55119) - A cross-origin property pollution issue exists. (Issue #55350)
last seen2020-06-01
modified2020-06-02
plugin id49285
published2010-09-20
reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/49285
titleGoogle Chrome < 6.0.472.62 Multiple Vulnerabilities
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(49285);
  script_version("1.20");
  script_cvs_date("Date: 2018/11/15 20:50:27");

  script_cve_id("CVE-2010-1822", "CVE-2010-3729", "CVE-2010-3730");
  script_bugtraq_id(43205, 43315, 44647);

  script_name(english:"Google Chrome < 6.0.472.62 Multiple Vulnerabilities");
  script_summary(english:"Checks version number of Google Chrome");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web browser that is affected by multiple
vulnerabilities.");

  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote host is earlier
than 6.0.472.62.  Such versions are reportedly affected by multiple
vulnerabilities :

  - There is a bad cast with malformed SVGs. (Issue #55114)

  - The buffer is mismanaged in the SPDY protocol.
    (Issue #55119)

  - A cross-origin property pollution issue exists.
    (Issue #55350)");

  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1a8fbf8b");
  script_set_attribute(attribute:"solution", value:"Upgrade to Google Chrome 6.0.472.62 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/09/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencies("google_chrome_installed.nasl");
  script_require_keys("SMB/Google_Chrome/Installed");

  exit(0);
}

include("google_chrome_version.inc");

get_kb_item_or_exit("SMB/Google_Chrome/Installed");

installs = get_kb_list("SMB/Google_Chrome/*");
google_chrome_check_version(installs:installs, fix:'6.0.472.62', severity:SECURITY_HOLE);

Oval

accepted2013-08-12T04:10:10.619-04:00
classvulnerability
contributors
  • nameJ. Daniel Brown
    organizationDTCC
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
definition_extensions
commentGoogle Chrome is installed
ovaloval:org.mitre.oval:def:11914
descriptionGoogle Chrome before 6.0.472.62 does not properly use information about the origin of a document to manage properties, which allows remote attackers to have an unspecified impact via a crafted web site, related to a "property pollution" issue.
familywindows
idoval:org.mitre.oval:def:7313
statusaccepted
submitted2010-10-07T17:30:00.000-05:00
titleGoogle Chrome Document Origin Properties Pollution Unspecified Issue
version51