PT-2014-3145 · Google+2 · Google Chrome+2

Joao Lucas Melo Brasio

·

Publicado

2014-01-14

·

Atualizado

2024-06-15

·

CVE-2013-6643

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 32.0.1700.76 on Windows Google Chrome versions prior to 32.0.1700.77 on Mac OS X and Linux
Description The issue allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialog. This is due to a problem in the OneClickSigninBubbleView::WindowClosing function.
Recommendations For Google Chrome versions prior to 32.0.1700.76 on Windows, update to version 32.0.1700.76 or later. For Google Chrome versions prior to 32.0.1700.77 on Mac OS X and Linux, update to version 32.0.1700.77 or later.

Exploit

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2014-1088
CVE-2013-6643
DSA-2862-1
MGASA-2014-0037
OPENSUSE-SU-2014_0243-1
OPENSUSE-SU-2024:10171-1
OPENSUSE-SU-2024:12948-1

Produtos afetados

Alt Linux
Google Chrome
Suse