Vulnerabilities > CVE-2013-0887 - Incorrect Permission Assignment for Critical Resource vulnerability in Google Chrome
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server, which has unspecified impact and attack vectors.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Accessing Functionality Not Properly Constrained by ACLs In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application or can run queries for data that he is otherwise not supposed to.
- Privilege Abuse An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.
- Directory Indexing An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
- Accessing, Modifying or Executing Executable Files An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
- Exploiting Incorrectly Configured Access Control Security Levels An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack. Most commonly, attackers would take advantage of controls that provided too little protection for sensitive activities in order to perform actions that should be denied to them. In some circumstances, an attacker may be able to take advantage of overly restrictive access control policies, initiating denial of services (if an application locks because it unexpectedly failed to be granted access) or causing other legitimate actions to fail due to security. The latter class of attacks, however, is usually less severe and easier to detect than attacks based on inadequate security restrictions. This attack pattern differs from CAPEC 1, "Accessing Functionality Not Properly Constrained by ACLs" in that the latter describes attacks where sensitive functionality lacks access controls, where, in this pattern, the access control is present, but incorrectly configured.
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-203.NASL description chromium was updated to version 27.0.1425 having both stability and security fixes : - Bug and stability fixes : - Fixed crash after clicking through malware warning. (Issue: 173986) - Fixed broken command line to create extensions with locale info (Issue: 176187) - Hosted apps in Chrome will always be opened from app launcher. (Issue: 176267) - Added modal confirmation dialog to the enterprise profile sign-in flow. (Issue: 171236) - Fixed a crash with autofill. (Issues: 175454, 176576) - Fixed issues with sign-in. (Issues: 175672, 175819, 175541, 176190) - Fixed spurious profile shortcuts created with a system-level install. (Issue: 177047) - Fixed the background tab flashing with certain themes. (Issue: 175426) - Security Fixes: (bnc#804986) - High CVE-2013-0879: Memory corruption with web audio node - High CVE-2013-0880: Use-after-free in database handling - Medium CVE-2013-0881: Bad read in Matroska handling - High CVE-2013-0882: Bad memory access with excessive SVG parameters. - Medium CVE-2013-0883: Bad read in Skia. - Low CVE-2013-0884: Inappropriate load of NaCl. - Medium CVE-2013-0885: Too many API permissions granted to web store - Medium CVE-2013-0886: Incorrect NaCl signal handling. - Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server - Medium CVE-2013-0888: Out-of-bounds read in Skia - Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads. - High CVE-2013-0890: Memory safety issues across the IPC layer. - High CVE-2013-0891: Integer overflow in blob handling. - Medium CVE-2013-0892: Lower severity issues across the IPC layer - Medium CVE-2013-0893: Race condition in media handling. - High CVE-2013-0894: Buffer overflow in vorbis decoding. - High CVE-2013-0895: Incorrect path handling in file copying. - High CVE-2013-0896: Memory management issues in plug-in message handling - Low CVE-2013-0897: Off-by-one read in PDF - High CVE-2013-0898: Use-after-free in URL handling - Low CVE-2013-0899: Integer overflow in Opus handling - Medium CVE-2013-0900: Race condition in ICU - Make adjustment for autodetecting of the PepperFlash library. The package with the PepperFlash hopefully will be soon available through packman - Update to 26.0.1411 - Bug and stability fixes - Update to 26.0.1403 - Bug and stability fixes - Using system libxml2 requires system libxslt. - Using system MESA does not work in i586 for some reason. - Also use system MESA, factory version seems adecuate now. - Always use system libxml2. - Restrict the usage of system libraries instead of the bundled ones to new products, too much hassle otherwise. - Also link kerberos and libgps directly, do not dlopen them. - Avoid using dlopen on system libraries, rpm or the package Manager do not handle this at all. tested for a few weeks and implemented with a macro so it can be easily disabled if problems arise. - Use SOME system libraries instead of the bundled ones, tested for several weeks and implemented with a macro for easy enable/Disable in case of trouble. - Update to 26.0.1393 - Bug and stability fixes - Security fixes - Update to 26.0.1375 - Bug and stability fixes - Update to 26.0.1371 - Bug and stability fixes - Update to 26.0.1367 - Bug and stability fixes last seen 2020-06-05 modified 2014-06-13 plugin id 74920 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74920 title openSUSE Security Update : chromium (openSUSE-SU-2013:0454-1) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_DFD92CB27D4811E2AD4800262D5ED8EE.NASL description Google Chrome Releases reports : [172243] High CVE-2013-0879: Memory corruption with web audio node. Credit to Atte Kettunen of OUSPG. [171951] High CVE-2013-0880: Use-after-free in database handling. Credit to Chamal de Silva. [167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG. [165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan. [142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG. [172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans). [172369] Medium CVE-2013-0885: Too many API permissions granted to web store. [171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server. [170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno). [170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads. [169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans). [169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Juri Aedla). [169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans). [168570] Medium CVE-2013-0893: Race condition in media handling. Credit to Andrew Scherkus of the Chromium development community. [168473] High CVE-2013-0894: Buffer overflow in vorbis decoding. Credit to Google Chrome Security Team (Inferno). [Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Juri Aedla). [166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar). [165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team. [164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community. [160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Juri Aedla). [152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno). last seen 2020-06-01 modified 2020-06-02 plugin id 64859 published 2013-02-24 reporter This script is Copyright (C) 2013-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/64859 title FreeBSD : chromium -- multiple vulnerabilities (dfd92cb2-7d48-11e2-ad48-00262d5ed8ee) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201309-16.NASL description The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact : A context-dependent attacker could entice a user to open a specially crafted website or JavaScript program using Chromium or V8, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to bypass security restrictions or have other, unspecified, impact. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 70112 published 2013-09-25 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70112 title GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities NASL family Windows NASL id GOOGLE_CHROME_25_0_1364_97.NASL description The version of Google Chrome installed on the remote host is a version prior to 25.0.1364.97. It is, therefore, affected by the following vulnerabilities : - An unspecified memory corruption error exists related to last seen 2020-06-01 modified 2020-06-02 plugin id 64813 published 2013-02-22 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/64813 title Google Chrome < 25.0.1364.97 Multiple Vulnerabilities
Oval
| accepted | 2013-08-12T04:08:01.480-04:00 | ||||||||||||
| class | vulnerability | ||||||||||||
| contributors |
| ||||||||||||
| definition_extensions |
| ||||||||||||
| description | The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server, which has unspecified impact and attack vectors. | ||||||||||||
| family | windows | ||||||||||||
| id | oval:org.mitre.oval:def:15788 | ||||||||||||
| status | accepted | ||||||||||||
| submitted | 2013-02-24T15:45:10.582-05:00 | ||||||||||||
| title | The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server | ||||||||||||
| version | 44 |
References
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15788
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
- https://code.google.com/p/chromium/issues/detail?id=170836
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html
- https://code.google.com/p/chromium/issues/detail?id=171065