Vulnerabilities > CVE-2016-5133 - Improper Authentication vulnerability in Google Chrome

047910
CVSS 5.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
high complexity
google
CWE-287
nessus
NVD
Published: 2016-07-23
Updated: 2024-11-21

Summary

Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream.

Vulnerable Configurations

Part Description Count
Application
Google
3766

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Authentication Abuse
    An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Utilizing REST's Trust in the System Resource to Register Man in the Middle
    This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to place man in the middle once SSL is terminated. Rest applications premise is that they leverage existing infrastructure to deliver web services functionality. An example of this is a Rest application that uses HTTP Get methods and receives a HTTP response with an XML document. These Rest style web services are deployed on existing infrastructure such as Apache and IIS web servers with no SOAP stack required. Unfortunately from a security standpoint, there frequently is no interoperable identity security mechanism deployed, so Rest developers often fall back to SSL to deliver security. In large data centers, SSL is typically terminated at the edge of the network - at the firewall, load balancer, or router. Once the SSL is terminated the HTTP request is in the clear (unless developers have hashed or encrypted the values, but this is rare). The attacker can utilize a sniffer such as Wireshark to snapshot the credentials, such as username and password that are passed in the clear once SSL is terminated. Once the attacker gathers these credentials, they can submit requests to the web service provider just as authorized user do. There is not typically an authentication on the client side, beyond what is passed in the request itself so once this is compromised, then this is generally sufficient to compromise the service's authentication scheme.
  • Man in the Middle Attack
    This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-1485.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 52.0.2743.82. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1706, CVE-2016-1708, CVE-2016-1709, CVE-2016-1710, CVE-2016-1711, CVE-2016-5127, CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131, CVE-2016-5132, CVE-2016-5133, CVE-2016-5134, CVE-2016-5135, CVE-2016-5136, CVE-2016-5137, CVE-2016-1705)
    last seen2020-05-31
    modified2016-07-26
    plugin id92552
    published2016-07-26
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92552
    titleRHEL 6 : chromium-browser (RHSA-2016:1485)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2016:1485. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(92552);
  script_version("2.16");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");

  script_cve_id("CVE-2016-1705", "CVE-2016-1706", "CVE-2016-1708", "CVE-2016-1709", "CVE-2016-1710", "CVE-2016-1711", "CVE-2016-5127", "CVE-2016-5128", "CVE-2016-5129", "CVE-2016-5130", "CVE-2016-5131", "CVE-2016-5132", "CVE-2016-5133", "CVE-2016-5134", "CVE-2016-5135", "CVE-2016-5136", "CVE-2016-5137");
  script_xref(name:"RHSA", value:"2016:1485");

  script_name(english:"RHEL 6 : chromium-browser (RHSA-2016:1485)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis",
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description",
    value:
"An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 52.0.2743.82.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web
content. A web page containing malicious content could cause Chromium
to crash, execute arbitrary code, or disclose sensitive information
when visited by the victim. (CVE-2016-1706, CVE-2016-1708,
CVE-2016-1709, CVE-2016-1710, CVE-2016-1711, CVE-2016-5127,
CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131,
CVE-2016-5132, CVE-2016-5133, CVE-2016-5134, CVE-2016-5135,
CVE-2016-5136, CVE-2016-5137, CVE-2016-1705)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2016:1485"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-1705"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-1706"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-1708"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-1709"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-1710"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-1711"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5127"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5128"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5129"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5130"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5131"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5132"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5133"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5134"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5135"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5136"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-5137"
  );
  script_set_attribute(
    attribute:"solution",
    value:
"Update the affected chromium-browser and / or
chromium-browser-debuginfo packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/07/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2016:1485";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;
  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;
  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-debuginfo-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;
  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-debuginfo-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium-browser / chromium-browser-debuginfo");
  }
}
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_52_0_2743_82.NASL
    descriptionThe version of Google Chrome installed on the remote Mac OS X host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified vulnerabilities exist that allow a remote attacker to cause a denial of service condition or possibly have other impact via unknown vectors. (CVE-2016-1705) - A sandbox protection bypass vulnerability exists in PPAPI due to a failure to validate the origin of IPC messages to the plugin broker process. An unauthenticated, remote attacker can exploit this to bypass the sandbox. (CVE-2016-1706) - A use-after-free error exists in Extensions due to a failure to consider object lifetimes during progress observation. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1708) - An array indexing error exists in the ByteArray::Get() function in data/byte_array.cc due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-1709) - A same-origin bypass vulnerability exists in Blink due to a failure to prevent window creation by a deferred frame. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1710) - A same-origin bypass vulnerability exists in Blink due to a failure to disable frame navigation during a detach operation on a DocumentLoader object. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1711) - A use-after-free error exists in Blink in the previousLinePosition() function. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5127) - A same-origin bypass vulnerability exists in Google V8 due to a failure to prevent API interceptors from modifying a store target without setting a property. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5128) - A flaw exists in V8 due to improper processing of left-trimmed objects. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5129) - A flaw exists that is triggered when handling two forward navigations that compete in different frames. A remote attacker can exploit this to conduct a URL spoofing attack. (CVE-2016-5130) - A use-after-free error exists in libxml2 in the xmlXPtrRangeToFunction() function. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5131) - A same-origin bypass vulnerability exists in the Service Workers subsystem due to a failure to properly implement the Secure Contexts specification during decisions about whether to control a subframe. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5132) - A flaw exists in the handling of origin information during proxy authentication that allows a man-in-the-middle attacker to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. (CVE-2016-5133) - A validation flaw exists in the Proxy Auto-Config (PAC) feature due to a failure to ensure that URL information is restricted to a scheme, host, and port. A remote attacker can exploit this to disclose credentials by operating a server with a PAC script. (CVE-2016-5134) - A cross-origin bypass vulnerability exists in Blink due to a failure to consider referrer-policy information inside an HTML document during a preload request. A remote attacker can exploit this to bypass the Content Security Policy (CSP) protection mechanism. (CVE-2016-5135) - A use-after-free error exists in Extensions that allows a remote attacker to dereference already freed memory, resulting in the execution of arbitrary code with elevated privileges. (CVE-2016-5136) - An information disclosure vulnerability exists in Blink when handling HTTP vs HTTPs ports in source expressions. An unauthenticated, remote attacker can exploit this to determine whether a specific HTTP Strict Transport Security (HSTS) web site has been visited by reading a CSP report. (CVE-2016-5137) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id92629
    published2016-07-29
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92629
    titleGoogle Chrome < 52.0.2743.82 Multiple Vulnerabilities (Mac OS X)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(92629);
  script_version("1.9");
  script_cvs_date("Date: 2018/07/14  1:59:36");

  script_cve_id(
    "CVE-2016-1705",
    "CVE-2016-1706",
    "CVE-2016-1708",
    "CVE-2016-1709",
    "CVE-2016-1710",
    "CVE-2016-1711",
    "CVE-2016-5127",
    "CVE-2016-5128",
    "CVE-2016-5129",
    "CVE-2016-5130",
    "CVE-2016-5131",
    "CVE-2016-5132",
    "CVE-2016-5133",
    "CVE-2016-5134",
    "CVE-2016-5135",
    "CVE-2016-5136",
    "CVE-2016-5137"
  );
  script_bugtraq_id(92053);

  script_name(english:"Google Chrome < 52.0.2743.82 Multiple Vulnerabilities (Mac OS X)");
  script_summary(english:"Checks the version of Google Chrome.");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote Mac OS X host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote Mac OS X host is
prior to 52.0.2743.82. It is, therefore, affected by multiple
vulnerabilities :

  - Multiple unspecified vulnerabilities exist that allow a
    remote attacker to cause a denial of service condition
    or possibly have other impact via unknown vectors.
    (CVE-2016-1705)

  - A sandbox protection bypass vulnerability exists in
    PPAPI due to a failure to validate the origin of IPC
    messages to the plugin broker process. An
    unauthenticated, remote attacker can exploit this to
    bypass the sandbox. (CVE-2016-1706)

  - A use-after-free error exists in Extensions due to a
    failure to consider object lifetimes during progress
    observation. An unauthenticated, remote attacker can
    exploit this to dereference already freed memory,
    resulting in the execution of arbitrary code.
    (CVE-2016-1708)

  - An array indexing error exists in the ByteArray::Get()
    function in data/byte_array.cc due to improper 
    validation of user-supplied input. An unauthenticated,
    remote attacker can exploit this to cause a heap-based
    buffer overflow, resulting in a denial of service
    condition or the execution of arbitrary code.
    (CVE-2016-1709)

  - A same-origin bypass vulnerability exists in Blink due
    to a failure to prevent window creation by a deferred
    frame. A remote attacker can exploit this to bypass the
    same-origin policy. (CVE-2016-1710)

  - A same-origin bypass vulnerability exists in Blink due
    to a failure to disable frame navigation during a detach
    operation on a DocumentLoader object. A remote attacker
    can exploit this to bypass the same-origin policy.
    (CVE-2016-1711)

  - A use-after-free error exists in Blink in the
    previousLinePosition() function. An unauthenticated,
    remote attacker can exploit this, via crafted JavaScript
    code involving an @import at-rule in a Cascading Style
    Sheets (CSS) token sequence in conjunction with a
    rel=import attribute of a LINK element, to cause a
    denial of service condition or the execution of
    arbitrary code. (CVE-2016-5127)

  - A same-origin bypass vulnerability exists in Google V8
    due to a failure to prevent API interceptors from
    modifying a store target without setting a property. A
    remote attacker can exploit this to bypass the
    same-origin policy. (CVE-2016-5128)

  - A flaw exists in V8 due to improper processing of
    left-trimmed objects. An unauthenticated, remote
    attacker can exploit this, via crafted JavaScript code,
    to cause a denial of service condition or the execution
    of arbitrary code. (CVE-2016-5129)

  - A flaw exists that is triggered when handling two
    forward navigations that compete in different frames. A
    remote attacker can exploit this to conduct a URL
    spoofing attack. (CVE-2016-5130)

  - A use-after-free error exists in libxml2 in the
    xmlXPtrRangeToFunction() function. An unauthenticated,
    remote attacker can exploit this to dereference already
    freed memory, resulting in the execution of arbitrary
    code. (CVE-2016-5131)

  - A same-origin bypass vulnerability exists in the Service
    Workers subsystem due to a failure to properly implement
    the Secure Contexts specification during decisions about
    whether to control a subframe. A remote attacker can
    exploit this to bypass the same-origin policy.
    (CVE-2016-5132)

  - A flaw exists in the handling of origin information
    during proxy authentication that allows a
    man-in-the-middle attacker to spoof a
    proxy-authentication login prompt or trigger incorrect
    credential storage by modifying the client-server data
    stream. (CVE-2016-5133)

  - A validation flaw exists in the Proxy Auto-Config (PAC)
    feature due to a failure to ensure that URL information
    is restricted to a scheme, host, and port. A remote
    attacker can exploit this to disclose credentials by
    operating a server with a PAC script. (CVE-2016-5134)

  - A cross-origin bypass vulnerability exists in Blink due
    to a failure to consider referrer-policy information
    inside an HTML document during a preload request. A
    remote attacker can exploit this to bypass the Content
    Security Policy (CSP) protection mechanism.
    (CVE-2016-5135)

  - A use-after-free error exists in Extensions that allows
    a remote attacker to dereference already freed memory,
    resulting in the execution of arbitrary code with
    elevated privileges. (CVE-2016-5136)

  - An information disclosure vulnerability exists in Blink
    when handling HTTP vs HTTPs ports in source expressions.
    An unauthenticated, remote attacker can exploit this to
    determine whether a specific HTTP Strict Transport
    Security (HSTS) web site has been visited by reading a
    CSP report. (CVE-2016-5137)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  # http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7c7c32d0");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome version 52.0.2743.82 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/07/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/29");

  script_set_attribute(attribute:"plugin_type",value:"local");
  script_set_attribute(attribute:"cpe",value:"cpe:/a:google:chrome");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.");

  script_dependencies("macosx_google_chrome_installed.nbin");
  script_require_keys("MacOSX/Google Chrome/Installed");

  exit(0);
}

include("google_chrome_version.inc");

get_kb_item_or_exit("MacOSX/Google Chrome/Installed");

google_chrome_check_version(fix:'52.0.2743.82', severity:SECURITY_HOLE);
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3637.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2016-1704 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-1705 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-1706 Pinkie Pie discovered a way to escape the Pepper Plugin API sandbox. - CVE-2016-1707 xisigr discovered a URL spoofing issue. - CVE-2016-1708 Adam Varsan discovered a use-after-free issue. - CVE-2016-1709 ChenQin discovered a buffer overflow issue in the sfntly library. - CVE-2016-1710 Mariusz Mlynski discovered a same-origin bypass. - CVE-2016-1711 Mariusz Mlynski discovered another same-origin bypass. - CVE-2016-5127 cloudfuzzer discovered a use-after-free issue. - CVE-2016-5128 A same-origin bypass issue was discovered in the v8 JavaScript library. - CVE-2016-5129 Jeonghoon Shin discovered a memory corruption issue in the v8 JavaScript library. - CVE-2016-5130 Widih Matar discovered a URL spoofing issue. - CVE-2016-5131 Nick Wellnhofer discovered a use-after-free issue in the libxml2 library. - CVE-2016-5132 Ben Kelly discovered a same-origin bypass. - CVE-2016-5133 Patch Eudor discovered an issue in proxy authentication. - CVE-2016-5134 Paul Stone discovered an information leak in the Proxy Auto-Config feature. - CVE-2016-5135 ShenYeYinJiu discovered a way to bypass the Content Security Policy. - CVE-2016-5136 Rob Wu discovered a use-after-free issue. - CVE-2016-5137 Xiaoyin Liu discovered a way to discover whether an HSTS website had been visited.
    last seen2020-06-01
    modified2020-06-02
    plugin id92666
    published2016-08-02
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92666
    titleDebian DSA-3637-1 : chromium-browser - security update
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-3637. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(92666);
  script_version("2.11");
  script_cvs_date("Date: 2019/07/15 14:20:30");

  script_cve_id("CVE-2016-1704", "CVE-2016-1705", "CVE-2016-1706", "CVE-2016-1707", "CVE-2016-1708", "CVE-2016-1709", "CVE-2016-1710", "CVE-2016-1711", "CVE-2016-5127", "CVE-2016-5128", "CVE-2016-5129", "CVE-2016-5130", "CVE-2016-5131", "CVE-2016-5132", "CVE-2016-5133", "CVE-2016-5134", "CVE-2016-5135", "CVE-2016-5136", "CVE-2016-5137");
  script_xref(name:"DSA", value:"3637");

  script_name(english:"Debian DSA-3637-1 : chromium-browser - security update");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several vulnerabilities have been discovered in the chromium web
browser.

  - CVE-2016-1704
    The chrome development team found and fixed various
    issues during internal auditing.

  - CVE-2016-1705
    The chrome development team found and fixed various
    issues during internal auditing.

  - CVE-2016-1706
    Pinkie Pie discovered a way to escape the Pepper Plugin
    API sandbox.

  - CVE-2016-1707
    xisigr discovered a URL spoofing issue.

  - CVE-2016-1708
    Adam Varsan discovered a use-after-free issue.

  - CVE-2016-1709
    ChenQin discovered a buffer overflow issue in the sfntly
    library.

  - CVE-2016-1710
    Mariusz Mlynski discovered a same-origin bypass.

  - CVE-2016-1711
    Mariusz Mlynski discovered another same-origin bypass.

  - CVE-2016-5127
    cloudfuzzer discovered a use-after-free issue.

  - CVE-2016-5128
    A same-origin bypass issue was discovered in the v8
    JavaScript library.

  - CVE-2016-5129
    Jeonghoon Shin discovered a memory corruption issue in
    the v8 JavaScript library.

  - CVE-2016-5130
    Widih Matar discovered a URL spoofing issue.

  - CVE-2016-5131
    Nick Wellnhofer discovered a use-after-free issue in the
    libxml2 library.

  - CVE-2016-5132
    Ben Kelly discovered a same-origin bypass.

  - CVE-2016-5133
    Patch Eudor discovered an issue in proxy authentication.

  - CVE-2016-5134
    Paul Stone discovered an information leak in the Proxy
    Auto-Config feature.

  - CVE-2016-5135
    ShenYeYinJiu discovered a way to bypass the Content
    Security Policy.

  - CVE-2016-5136
    Rob Wu discovered a use-after-free issue.

  - CVE-2016-5137
    Xiaoyin Liu discovered a way to discover whether an HSTS
    website had been visited."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1704"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1705"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1706"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1707"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1708"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1709"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1710"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-1711"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5127"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5128"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5129"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5130"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5131"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5132"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5133"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5134"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5135"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5136"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2016-5137"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/jessie/chromium-browser"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2016/dsa-3637"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the chromium-browser packages.

For the stable distribution (jessie), these problems have been fixed
in version 52.0.2743.82-1~deb8u1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:chromium-browser");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/08/02");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"8.0", prefix:"chromedriver", reference:"52.0.2743.82-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"chromium", reference:"52.0.2743.82-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"chromium-dbg", reference:"52.0.2743.82-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"chromium-inspector", reference:"52.0.2743.82-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"chromium-l10n", reference:"52.0.2743.82-1~deb8u1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-919.NASL
    descriptionChromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) : - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-08-01
    plugin id92655
    published2016-08-01
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92655
    titleopenSUSE Security Update : Chromium (openSUSE-2016-919)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-901.NASL
    descriptionChromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) : - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-07-26
    plugin id92551
    published2016-07-26
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92551
    titleopenSUSE Security Update : Chromium (openSUSE-2016-901)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-98BED96D12.NASL
    descriptionThis update updates QtWebEngine to a snapshot from the Qt 5.6 LTS (long-term support) branch. This is a snapshot of the QtWebEngine that will be included in the bugfix and security release Qt 5.6.3, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.6.2: CVE-2016-5133, CVE-2016-5147, CVE-2016-5153, CVE-2016-5155, CVE-2016-5161, CVE-2016-5166, CVE-2016-5170, CVE-2016-5171, CVE-2016-5172, CVE-2016-5181, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5192, CVE-2016-5198, CVE-2016-5205, CVE-2016-5207, CVE-2016-5208, CVE-2016-5214, CVE-2016-5215, CVE-2016-5221, CVE-2016-5222, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650, CVE-2016-9651, CVE-2016-9652, CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5012, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5019, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5033, CVE-2017-5037, CVE-2017-5044, CVE-2017-5046, CVE-2017-5047, CVE-2017-5048, CVE-2017-5049, CVE-2017-5050, CVE-2017-5051, CVE-2017-5059, CVE-2017-5061, CVE-2017-5062, CVE-2017-5065, CVE-2017-5067, CVE-2017-5069, CVE-2017-5070, CVE-2017-5071, CVE-2017-5075, CVE-2017-5076, CVE-2016-5078, CVE-2017-5083, and CVE-2017-5089. Other important changes include : - Based on Chromium 49.0.2623.111 (the version used in QtWebEngine 5.7.x) with security fixes from Chromium up to version 59.0.3071.104. (5.6.2 was based on Chromium 45.0.2554.101 with security fixes from Chromium up to version 52.0.2743.116.) - All other bug fixes from QtWebEngine 5.7.1 have been backported. See http://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.6.3?h=5. 6 for details. (Please note that at the time of this writing, not all security backports are listed in that file yet. The list above is accurate.) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-07-24
    plugin id101920
    published2017-07-24
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101920
    titleFedora 24 : qt5-qtwebengine (2017-98bed96d12)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_6FAE9FE1504811E68AA73065EC8FD3EC.NASL
    descriptionGoogle Chrome Releases reports : 48 security fixes in this release, including : - [610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to Pinkie Pie xisigr of Tencent
    last seen2020-06-01
    modified2020-06-02
    plugin id92537
    published2016-07-25
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92537
    titleFreeBSD : chromium -- multiple vulnerabilities (6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3041-1.NASL
    descriptionMultiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1705) It was discovered that the PPAPI implementation does not validate the origin of IPC messages to the plugin broker process. A remote attacker could potentially exploit this to bypass sandbox protection mechanisms. (CVE-2016-1706) It was discovered that Blink does not prevent window creation by a deferred frame. A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1710) It was discovered that Blink does not disable frame navigation during a detach operation on a DocumentLoader object. A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1711) A use-after-free was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer process crash, or execute arbitrary code. (CVE-2016-5127) It was discovered that objects.cc in V8 does not prevent API interceptors from modifying a store target without setting a property. A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-5128) A memory corruption was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer process crash, or execute arbitrary code. (CVE-2016-5129) A security issue was discovered in Chromium. A remote attacker could potentially exploit this to spoof the currently displayed URL. (CVE-2016-5130) A use-after-free was discovered in libxml. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer process crash, or execute arbitrary code. (CVE-2016-5131) The Service Workers implementation in Chromium does not properly implement the Secure Contexts specification during decisions about whether to control a subframe. A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-5132) It was discovered that Chromium mishandles origin information during proxy authentication. A man-in-the-middle attacker could potentially exploit this to spoof a proxy authentication login prompt. (CVE-2016-5133) It was discovered that the Proxy Auto-Config (PAC) feature in Chromium does not ensure that URL information is restricted to a scheme, host and port. A remote attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5134) It was discovered that Blink does not consider referrer-policy information inside an HTML document during a preload request. A remote attacker could potentially exploit this to bypass Content Security Policy (CSP) protections. (CVE-2016-5135) It was discovered that the Content Security Policy (CSP) implementation in Blink does not apply http :80 policies to https :443 URLs. A remote attacker could potentially exploit this to determine whether a specific HSTS website has been visited by reading a CSP report. (CVE-2016-5137). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id92784
    published2016-08-08
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92784
    titleUbuntu 14.04 LTS / 16.04 LTS : oxide-qt vulnerabilities (USN-3041-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-900.NASL
    descriptionChromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) : - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-07-26
    plugin id92550
    published2016-07-26
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92550
    titleopenSUSE Security Update : Chromium (openSUSE-2016-900)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201610-09.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201610-09 (Chromium: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id94420
    published2016-10-31
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94420
    titleGLSA-201610-09 : Chromium: Multiple vulnerabilities
  • NASL familyWindows
    NASL idGOOGLE_CHROME_52_0_2743_82.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified vulnerabilities exist that allow a remote attacker to cause a denial of service condition or possibly have other impact via unknown vectors. (CVE-2016-1705) - A sandbox protection bypass vulnerability exists in PPAPI due to a failure to validate the origin of IPC messages to the plugin broker process. An unauthenticated, remote attacker can exploit this to bypass the sandbox. (CVE-2016-1706) - A use-after-free error exists in Extensions due to a failure to consider object lifetimes during progress observation. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1708) - An array indexing error exists in the ByteArray::Get() function in data/byte_array.cc due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-1709) - A same-origin bypass vulnerability exists in Blink due to a failure to prevent window creation by a deferred frame. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1710) - A same-origin bypass vulnerability exists in Blink due to a failure to disable frame navigation during a detach operation on a DocumentLoader object. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1711) - A use-after-free error exists in Blink in the previousLinePosition() function. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5127) - A same-origin bypass vulnerability exists in Google V8 due to a failure to prevent API interceptors from modifying a store target without setting a property. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5128) - A flaw exists in V8 due to improper processing of left-trimmed objects. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5129) - A flaw exists that is triggered when handling two forward navigations that compete in different frames. A remote attacker can exploit this to conduct a URL spoofing attack. (CVE-2016-5130) - A use-after-free error exists in libxml2 in the xmlXPtrRangeToFunction() function. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5131) - A same-origin bypass vulnerability exists in the Service Workers subsystem due to a failure to properly implement the Secure Contexts specification during decisions about whether to control a subframe. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5132) - A flaw exists in the handling of origin information during proxy authentication that allows a man-in-the-middle attacker to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. (CVE-2016-5133) - A validation flaw exists in the Proxy Auto-Config (PAC) feature due to a failure to ensure that URL information is restricted to a scheme, host, and port. A remote attacker can exploit this to disclose credentials by operating a server with a PAC script. (CVE-2016-5134) - A cross-origin bypass vulnerability exists in Blink due to a failure to consider referrer-policy information inside an HTML document during a preload request. A remote attacker can exploit this to bypass the Content Security Policy (CSP) protection mechanism. (CVE-2016-5135) - A use-after-free error exists in Extensions that allows a remote attacker to dereference already freed memory, resulting in the execution of arbitrary code with elevated privileges. (CVE-2016-5136) - An information disclosure vulnerability exists in Blink when handling HTTP vs HTTPs ports in source expressions. An unauthenticated, remote attacker can exploit this to determine whether a specific HTTP Strict Transport Security (HSTS) web site has been visited by reading a CSP report. (CVE-2016-5137) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id92628
    published2016-07-29
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92628
    titleGoogle Chrome < 52.0.2743.82 Multiple Vulnerabilities

Redhat

advisories
rhsa
idRHSA-2016:1485
rpms
  • chromium-browser-0:52.0.2743.82-1.el6
  • chromium-browser-debuginfo-0:52.0.2743.82-1.el6

References