Vulnerabilities > CVE-2015-1284 - Improper Input Validation vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-513.NASL description Chromium was updated to 44.0.2403.89 to fix multiple security issues. The following vulnerabilities were fixed : - CVE-2015-1271: Heap-buffer-overflow in pdfium - CVE-2015-1273: Heap-buffer-overflow in pdfium - CVE-2015-1274: Settings allowed executable files to run immediately after download - CVE-2015-1275: UXSS in Chrome for Android - CVE-2015-1276: Use-after-free in IndexedDB - CVE-2015-1279: Heap-buffer-overflow in pdfium - CVE-2015-1280: Memory corruption in skia - CVE-2015-1281: CSP bypass - CVE-2015-1282: Use-after-free in pdfium - CVE-2015-1283: Heap-buffer-overflow in expat - CVE-2015-1284: Use-after-free in blink - CVE-2015-1286: UXSS in blink - CVE-2015-1287: SOP bypass with CSS - CVE-2015-1270: Uninitialized memory read in ICU - CVE-2015-1272: Use-after-free related to unexpected GPU process termination - CVE-2015-1277: Use-after-free in accessibility - CVE-2015-1278: URL spoofing using pdf files - CVE-2015-1285: Information leak in XSS auditor - CVE-2015-1288: Spell checking dictionaries fetched over HTTP - CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives - CVE-2015-5605: Rgular-expression implementation mishandles interrupts, DoS via JS The following non-security changes are included : - A number of new apps/extension APIs - Lots of under the hood changes for stability and performance - Pepper Flash plugin updated to 18.0.0.209 last seen 2020-06-05 modified 2015-07-27 plugin id 85003 published 2015-07-27 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/85003 title openSUSE Security Update : Chromium (openSUSE-2015-513) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201603-09.NASL description The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 89902 published 2016-03-14 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/89902 title GLSA-201603-09 : Chromium: Multiple vulnerabilities NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3315.NASL description Several vulnerabilities were discovered in the chromium web browser. - CVE-2015-1266 Intended access restrictions could be bypassed for certain URLs like chrome://gpu. - CVE-2015-1267 A way to bypass the Same Origin Policy was discovered. - CVE-2015-1268 Mariusz Mlynski also discovered a way to bypass the Same Origin Policy. - CVE-2015-1269 Mike Rudy discovered that hostnames were not properly compared in the HTTP Strict Transport Policy and HTTP Public Key Pinning features, which could allow those access restrictions to be bypassed. - CVE-2015-1270 Atte Kettunen discovered an uninitialized memory read in the ICU library. - CVE-2015-1271 cloudfuzzer discovered a buffer overflow in the pdfium library. - CVE-2015-1272 Chamal de Silva discovered race conditions in the GPU process implementation. - CVE-2015-1273 makosoft discovered a buffer overflow in openjpeg, which is used by the pdfium library embedded in chromium. - CVE-2015-1274 andrewm.bpi discovered that the auto-open list allowed certain file types to be executed immediately after download. - CVE-2015-1276 Colin Payne discovered a use-after-free issue in the IndexedDB implementation. - CVE-2015-1277 SkyLined discovered a use-after-free issue in chromium last seen 2020-06-01 modified 2020-06-02 plugin id 84992 published 2015-07-27 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84992 title Debian DSA-3315-1 : chromium-browser - security update NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2677-1.NASL description An uninitialized value issue was discovered in ICU. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-1270) A use-after-free was discovered in the GPU process implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1272) A use-after-free was discovered in the IndexedDB implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1276) A use-after-free was discovered in the accessibility implemetation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1277) A memory corruption issue was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1280) It was discovered that Blink did not properly determine the V8 context of a microtask in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass Content Security Policy (CSP) restrictions. (CVE-2015-1281) Multiple integer overflows were discovered in Expat. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1283) It was discovered that Blink did not enforce a page last seen 2020-06-01 modified 2020-06-02 plugin id 85240 published 2015-08-05 reporter Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/85240 title Ubuntu 14.04 LTS / 15.04 : oxide-qt vulnerabilities (USN-2677-1) NASL family Windows NASL id GOOGLE_CHROME_44_0_2403_89.NASL description The version of Google Chrome installed on the remote Windows host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities : - An uninitialized memory read flaw exists in ICU that an attacker can exploit to have unspecified impact. (CVE-2015-1270) - A heap buffer overflow condition exists in PDFium due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-1271, CVE-2015-1273) - A use-after-free memory error exists when the GPU process is unexpectedly terminated. An attacker can exploit this to have an unspecified impact. (CVE-2015-1272) - The settings for automatic downloading of files allows EXE files to be auto-opened, which can result in the execution of malicious code. (CVE-2015-1274) - A universal cross-site scripting (UXSS) vulnerability exists in Google Chrome for Android due to improper validation of last seen 2020-06-01 modified 2020-06-02 plugin id 84921 published 2015-07-22 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84921 title Google Chrome < 44.0.2403.89 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-953.NASL description Qt 5 was updated to the 5.5.1 release to deliver upstream improvements and fixes to Qt functionality. The following Security fixes are contained in QtWebEngineCore : - ICU: CVE-2014-8146, CVE-2014-8147 - Blink: CVE-2015-1284, CVE-2015-1291, CVE-2015-1292 - Skia: CVE-2015-1294 - V8: CVE-2015-1290 The following packages were rebuilt because they use private headers : - calibre - fcitx-qt5 - frameworkintegration - kwayland - kwin5, - lxqt-powermanagement - lxqt-qtplugin last seen 2020-06-05 modified 2015-12-29 plugin id 87627 published 2015-12-29 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/87627 title openSUSE Security Update : Qt 5 (openSUSE-2015-953) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_9D73207832C711E5B26300262D5ED8EE.NASL description Google Chrome Releases reports : 43 security fixes in this release, including : - [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer. - [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft. - [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi. - [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team. - [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne. - [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon. - [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer. - [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa. - [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva. - [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa. - [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG. - [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous. - [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team. - [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor. - [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU. Credit to Atte Kettunen of OUSPG. - [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva. - [479743] Medium CVE-2015-1277: Use-after-free in accessibility. Credit to SkyLined. - [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva. - [498982] Medium CVE-2015-1285: Information leak in XSS auditor. Credit to gazheyes. - [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to [email protected]. - [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives. last seen 2020-06-01 modified 2020-06-02 plugin id 84994 published 2015-07-27 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84994 title FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2015-1499.NASL description Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Chromium is an open source web browser, powered by WebKit (Blink). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1271, CVE-2015-1270, CVE-2015-1272, CVE-2015-1273, CVE-2015-1274, CVE-2015-1276, CVE-2015-1277, CVE-2015-1278, CVE-2015-1279, CVE-2015-1281, CVE-2015-1282, CVE-2015-1283, CVE-2015-1284, CVE-2015-1285, CVE-2015-1286, CVE-2015-1287, CVE-2015-1288, CVE-2015-1289, CVE-2015-5605) All Chromium users should upgrade to these updated packages, which contain Chromium version 44.0.2403.89, which corrects these issues. After installing the update, Chromium must be restarted for the changes to take effect. last seen 2020-05-31 modified 2015-07-28 plugin id 85039 published 2015-07-28 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/85039 title RHEL 6 : chromium-browser (RHSA-2015:1499) NASL family MacOS X Local Security Checks NASL id MACOSX_GOOGLE_CHROME_44_0_2403_89.NASL description The version of Google Chrome installed on the remote Mac OS X host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities : - An uninitialized memory read flaw exists in ICU that an attacker can exploit to have unspecified impact. (CVE-2015-1270) - A heap buffer overflow condition exists in PDFium due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-1271, CVE-2015-1273) - A use-after-free memory error exists when the GPU process is unexpectedly terminated. An attacker can exploit this to have an unspecified impact. (CVE-2015-1272) - The settings for automatic downloading of files allows EXE files to be auto-opened, which can result in the execution of malicious code. (CVE-2015-1274) - A universal cross-site scripting (UXSS) vulnerability exists in Google Chrome for Android due to improper validation of last seen 2020-06-01 modified 2020-06-02 plugin id 84922 published 2015-07-22 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84922 title Google Chrome < 44.0.2403.89 Multiple Vulnerabilities (Mac OS X)
Redhat
| advisories |
| ||||
| rpms |
|
References
- http://rhn.redhat.com/errata/RHSA-2015-1499.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html
- http://www.securitytracker.com/id/1033031
- https://security.gentoo.org/glsa/201603-09
- https://code.google.com/p/chromium/issues/detail?id=493243
- http://www.securityfocus.com/bid/75973
- http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html
- http://www.debian.org/security/2015/dsa-3315
- https://src.chromium.org/viewvc/blink?revision=197139&view=revision