PT-2014-5127 · Google · Google Chrome

Matias Brutti · Publicado 2014-10-08 · Atualizado 2014-10-08 · CVE-2014-3187

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 37.0.2062.60 Google Chrome version 38.x prior to 38.0.2125.59 on iOS

Description The issue allows remote attackers to obtain video and audio data from a device via a crafted web site, due to improper restriction of processing of facetime:// and facetime-audio:// URLs.

Recommendations For Google Chrome versions prior to 37.0.2062.60, update to version 37.0.2062.60 or later. For Google Chrome version 38.x prior to 38.0.2125.59 on iOS, update to version 38.0.2125.59 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-3187

Produtos afetados

Google Chrome

Referências · 5

• 🔥 https://medium.com/section-9-lab/abusing-ios-url-handlers-on-messages-96979e8b12f5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3187 · Nota de Segurança
• http://googlechromereleases.blogspot.com/2014/10/chrome-for-ios-update.html · Nota
• http://twitter.com/S9Labs/statuses/519576582742999043 · Nota
• https://code.google.com/p/chromium/issues/detail?id=413831 · Nota