Vulnerabilities > CVE-2011-1285 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Chrome

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
google
CWE-119
nessus
NVD
Published: 2011-03-11
Updated: 2017-09-19

Summary

The regular-expression functionality in Google Chrome before 10.0.648.127 does not properly implement reentrancy, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

Vulnerable Configurations

Part Description Count
Application
Google
1194

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Msbulletin

bulletin_idMS11-056
bulletin_url
date2011-07-12T00:00:00
impactElevation of Privilege
knowledgebase_id2507938
knowledgebase_url
severityImportant
titleVulnerabilities in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege

Nessus

NASL familyWindows
NASL idGOOGLE_CHROME_10_0_648_127.NASL
descriptionThe version of Google Chrome installed on the remote host is earlier than 10.0.648.127. Such versions are reportedly affected by multiple vulnerabilities : - It may be possible to navigate or close the top location in a sandboxed frame. (Issue #42574, #42765) - A cross-origin error message leak exists. (Issue #69187) - A memory corruption issue exists with counter nodes. (Issue #69628) - An unspecified issue exists with stale nodes in box layout. (Issue #70027) - A cross-origin error message leak exists with workers. (Issue #70336) - A use-after-free error exists with DOM URL handling. (Issue #70442) - A same origin policy bypass exists in v8. (Issue #70877) - It may be possible to bypass the pop-up blocker. (Issue #70885, #71167) - A use-after-free error exists in document script lifetime handling. (Issue #71763) - An out-of-bounds write issue exists in the OGG container. (Issue #71788) - A stale pointer exists in table painting. (Issue #72028) - A corrupt out-of-bounds structure may be used in video code. (Issue #73026) - It may be possible to crash the application with the DataView object. (Issue #73066) - A bad cast exists in text rendering. (Issue #73134) - A stale pointer exists in the WebKit context code. (Issue #73196) - It may be possible for heap addresses to leak in XSLT. (Issue #73716) - A stale pointer exists with SVG cursors. (Issue #73746) - It is possible for the DOM tree to be corrupted with attribute handling. (Issue #74030) - An unspecified corruption exists via re-entrancy of RegExp code. (Issue #74662) - An invalid memory access exists in v8. (Issue #74675)
last seen2020-06-01
modified2020-06-02
plugin id52589
published2011-03-09
reporterThis script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/52589
titleGoogle Chrome < 10.0.648.127 Multiple Vulnerabilities
code
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(52589);
  script_version("1.25");
  script_cvs_date("Date: 2018/11/15 20:50:26");

  script_cve_id(
    "CVE-2011-1185",
    "CVE-2011-1187",
    "CVE-2011-1188",
    "CVE-2011-1189",
    "CVE-2011-1190",
    "CVE-2011-1191",
    "CVE-2011-1193",
    "CVE-2011-1194",
    "CVE-2011-1195",
    "CVE-2011-1196",
    "CVE-2011-1197",
    "CVE-2011-1198",
    "CVE-2011-1199",
    "CVE-2011-1200",
    "CVE-2011-1201",
    "CVE-2011-1202",
    "CVE-2011-1203",
    "CVE-2011-1204",
    "CVE-2011-1285",
    "CVE-2011-1286"
  );
  script_bugtraq_id(46785, 47668, 50062);
  script_xref(name:"Secunia", value:"43683");

  script_name(english:"Google Chrome < 10.0.648.127 Multiple Vulnerabilities");
  script_summary(english:"Checks version number of Google Chrome");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web browser that is affected by multiple
vulnerabilities.");

  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote host is earlier
than 10.0.648.127.  Such versions are reportedly affected by multiple
vulnerabilities :

  - It may be possible to navigate or close the top location
    in a sandboxed frame. (Issue #42574, #42765)

  - A cross-origin error message leak exists. (Issue #69187)

  - A memory corruption issue exists with counter nodes.
    (Issue #69628)

  - An unspecified issue exists with stale nodes in box
    layout. (Issue #70027)

  - A cross-origin error message leak exists with workers.
    (Issue #70336)

  - A use-after-free error exists with DOM URL handling.
    (Issue #70442)

  - A same origin policy bypass exists in v8. (Issue #70877)

  - It may be possible to bypass the pop-up blocker.
    (Issue #70885, #71167)

  - A use-after-free error exists in document script
    lifetime handling. (Issue #71763)

  - An out-of-bounds write issue exists in the OGG
    container. (Issue #71788)

  - A stale pointer exists in table painting. (Issue #72028)

  - A corrupt out-of-bounds structure may be used in video
    code. (Issue #73026)

  - It may be possible to crash the application with the
    DataView object. (Issue #73066)

  - A bad cast exists in text rendering. (Issue #73134)

  - A stale pointer exists in the WebKit context code.
    (Issue #73196)

  - It may be possible for heap addresses to leak in XSLT.
    (Issue #73716)

  - A stale pointer exists with SVG cursors. (Issue #73746)

  - It is possible for the DOM tree to be corrupted with
    attribute handling. (Issue #74030)

  - An unspecified corruption exists via re-entrancy of
    RegExp code. (Issue #74662)

  - An invalid memory access exists in v8. (Issue #74675)");

  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b08665a2");
  script_set_attribute(attribute:"solution", value:"Upgrade to Google Chrome 10.0.648.127 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/03/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/03/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");

  script_dependencies("google_chrome_installed.nasl");
  script_require_keys("SMB/Google_Chrome/Installed");

  exit(0);
}

include("google_chrome_version.inc");

get_kb_item_or_exit("SMB/Google_Chrome/Installed");

installs = get_kb_list("SMB/Google_Chrome/*");
google_chrome_check_version(installs:installs, fix:'10.0.648.127', severity:SECURITY_WARNING);

Oval

accepted2014-04-07T04:01:33.343-04:00
classvulnerability
contributors
  • nameScott Quint
    organizationDTCC
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
  • commentGoogle Chrome is installed
    ovaloval:org.mitre.oval:def:11914
descriptionThe regular-expression functionality in Google Chrome before 10.0.648.127 does not properly implement reentrancy, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
familywindows
idoval:org.mitre.oval:def:14571
statusaccepted
submitted2011-12-09T10:40:25.000-05:00
titleThe regular-expression functionality in Google Chrome before 10.0.648.127 does not properly implement reentrancy, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
version52

References