PT-2017-3227 · Google+4 · Google Chrome+4
Publicado
2017-06-05
·
Atualizado
2024-06-15
·
CVE-2017-5076
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 59.0.3071.86 for Mac, Windows, and Linux
Google Chrome versions prior to 59.0.3071.92 for Android
Description
The issue is related to insufficient policy enforcement in the Omnibox feature of Google Chrome, allowing a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. This can be achieved by using specially formed domain names that include IDN homographs, potentially leading to domain substitution.
Recommendations
For Google Chrome versions prior to 59.0.3071.86 on Mac, Windows, and Linux, update to version 59.0.3071.86 or later.
For Google Chrome versions prior to 59.0.3071.92 on Android, update to version 59.0.3071.92 or later.
As a temporary workaround, consider restricting access to potentially vulnerable domains until the issue is resolved.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse