Vulnerabilities > CVE-2011-0984 - Out-Of-Bounds Read vulnerability in Google Chrome

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
google
debian
CWE-125
nessus

Summary

Google Chrome before 9.0.597.94 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

Vulnerable Configurations

Part Description Count
Application
Google
1072
OS
Debian
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyWindows
    NASL idGOOGLE_CHROME_9_0_597_94.NASL
    descriptionThe version of Google Chrome installed on the remote host is earlier than 9.0.597.94. Such versions are reportedly affected by multiple vulnerabilities : - An error exists in the processing of animations events related to stale pointers. (Issue #67234) - An error exists in the processing of SVG font faces which allows attempts to use already freed resources. (Issue #68120) - An error exists in the processing of anonymous blocks related to stale pointers. (Issue #69556) - Errors exist in the processing of plugins which allow out-of-bounds reads to occur. (Issue #69970) - An error exists in the handling of out-of-memory conditions and does not always allow processes to be properly terminated. (Issue #70456)
    last seen2020-06-01
    modified2020-06-02
    plugin id51921
    published2011-02-09
    reporterThis script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51921
    titleGoogle Chrome < 9.0.597.94 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(51921);
      script_version("1.15");
      script_cvs_date("Date: 2018/11/15 20:50:27");
    
      script_cve_id(
        "CVE-2011-0981",
        "CVE-2011-0982",
        "CVE-2011-0983",
        "CVE-2011-0984",
        "CVE-2011-0985"
      );
      script_bugtraq_id(46262);
      script_xref(name:"Secunia", value:"43021");
    
      script_name(english:"Google Chrome < 9.0.597.94 Multiple Vulnerabilities");
      script_summary(english:"Checks version number of Google Chrome");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host contains a web browser that is affected by multiple
    vulnerabilities.");
    
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote host is earlier
    than 9.0.597.94.  Such versions are reportedly affected by multiple
    vulnerabilities :
    
      - An error exists in the processing of animations events
        related to stale pointers. (Issue #67234)
    
      - An error exists in the processing of SVG font faces
        which allows attempts to use already freed resources.
        (Issue #68120)
    
      - An error exists in the processing of anonymous blocks
        related to stale pointers. (Issue #69556)
    
      - Errors exist in the processing of plugins which allow
        out-of-bounds reads to occur. (Issue #69970)
    
      - An error exists in the handling of out-of-memory
        conditions and does not always allow processes to be
        properly terminated. (Issue #70456)");
    
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4a1f59e2");
      script_set_attribute(attribute:"solution", value:"Upgrade to Google Chrome 9.0.597.94 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/02/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/02/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/02/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");
    
      script_dependencies("google_chrome_installed.nasl");
      script_require_keys("SMB/Google_Chrome/Installed");
    
      exit(0);
    }
    
    include("google_chrome_version.inc");
    
    get_kb_item_or_exit("SMB/Google_Chrome/Installed");
    
    installs = get_kb_list("SMB/Google_Chrome/*");
    google_chrome_check_version(installs:installs, fix:'9.0.597.94', severity:SECURITY_HOLE);
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2166.NASL
    descriptionSeveral vulnerabilities were discovered in the Chromium browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-0777 Use-after-free vulnerability in Google Chrome before 9.0.597.84 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to image loading. - CVE-2011-0778 Google Chrome before 9.0.597.84 does not properly restrict drag and drop operations, which might allow remote attackers to bypass the Same Origin Policy via unspecified vectors. - CVE-2011-0783 Unspecified vulnerability in Google Chrome before 9.0.597.84 allows user-assisted remote attackers to cause a denial of service (application crash) via vectors involving a
    last seen2020-03-17
    modified2011-02-20
    plugin id52029
    published2011-02-20
    reporterThis script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/52029
    titleDebian DSA-2166-1 : chromium-browser - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-2166. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(52029);
      script_version("1.12");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2011-0777", "CVE-2011-0778", "CVE-2011-0783", "CVE-2011-0981", "CVE-2011-0983", "CVE-2011-0984", "CVE-2011-0985");
      script_bugtraq_id(46144, 46262);
      script_xref(name:"DSA", value:"2166");
    
      script_name(english:"Debian DSA-2166-1 : chromium-browser - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities were discovered in the Chromium browser. The
    Common Vulnerabilities and Exposures project identifies the following
    problems :
    
      - CVE-2011-0777
        Use-after-free vulnerability in Google Chrome before
        9.0.597.84 allows remote attackers to cause a denial of
        service or possibly have unspecified other impact via
        vectors related to image loading.
    
      - CVE-2011-0778
        Google Chrome before 9.0.597.84 does not properly
        restrict drag and drop operations, which might allow
        remote attackers to bypass the Same Origin Policy via
        unspecified vectors.
    
      - CVE-2011-0783
        Unspecified vulnerability in Google Chrome before
        9.0.597.84 allows user-assisted remote attackers to
        cause a denial of service (application crash) via
        vectors involving a 'bad volume setting'.
    
      - CVE-2011-0983
        Google Chrome before 9.0.597.94 does not properly handle
        anonymous blocks, which allows remote attackers to cause
        a denial of service or possibly have unspecified other
        impact via unknown vectors that lead to a 'stale
        pointer'.
    
      - CVE-2011-0981
        Google Chrome before 9.0.597.94 does not properly
        perform event handling for animations, which allows
        remote attackers to cause a denial of service or
        possibly have unspecified other impact via unknown
        vectors that lead to a'stale pointer'.
    
      - CVE-2011-0984
        Google Chrome before 9.0.597.94 does not properly handle
        plug-ins, which allows remote attackers to cause a
        denial of service (out-of-bounds read) via unspecified
        vectors.
    
      - CVE-2011-0985
        Google Chrome before 9.0.597.94 does not properly
        perform process termination upon memory exhaustion,
        which has unspecified impact and remote attack vectors."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2011-0777"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2011-0778"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2011-0783"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2011-0983"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2011-0981"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2011-0984"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2011-0985"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/squeeze/chromium-browser"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2011/dsa-2166"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the chromium-browser packages.
    
    For the stable distribution (squeeze), these problems have been fixed
    in version 6.0.472.63~r59945-5+squeeze2."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:chromium-browser");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/02/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/02/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"6.0", prefix:"chromium-browser", reference:"6.0.472.63~r59945-5+squeeze2")) flag++;
    if (deb_check(release:"6.0", prefix:"chromium-browser-dbg", reference:"6.0.472.63~r59945-5+squeeze2")) flag++;
    if (deb_check(release:"6.0", prefix:"chromium-browser-inspector", reference:"6.0.472.63~r59945-5+squeeze2")) flag++;
    if (deb_check(release:"6.0", prefix:"chromium-browser-l10n", reference:"6.0.472.63~r59945-5+squeeze2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Oval

accepted2014-04-07T04:01:46.389-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationDTCC
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
descriptionGoogle Chrome before 9.0.597.94 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
familywindows
idoval:org.mitre.oval:def:14719
statusaccepted
submitted2011-12-09T10:38:01.000-05:00
titleGoogle Chrome before 9.0.597.94 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
version52