PT-2008-6799 · Google · Google Chrome

Nine:Situations:Group · Published 2008-12-29 · Updated 2024-08-07 · CVE-2008-5749

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome version 1.0.154.36

Description The issue allows remote attackers to execute arbitrary commands via the --renderer-path option in a "chromehtml: URI" API endpoint. A third party disputes this issue, stating that Chrome will ask for user permission and cannot launch the applet even if permission is given.

Recommendations For Google Chrome version 1.0.154.36, consider disabling the --renderer-path option as a temporary workaround until a patch is available. Restrict access to the "chromehtml: URI" API endpoint to minimize the risk of exploitation. Avoid using the --renderer-path option in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-5749

Affected Products

Google Chrome

References · 9

• 🔥 http://retrogod.altervista.org/9sg_chrome.html · Exploit
• 🔥 https://exploit-db.com/exploits/7566 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5749 · Security Note
• http://securityfocus.com/archive/1/499570/100/0/threaded · Note
• http://securityreason.com/securityalert/4821 · Note
• http://securityfocus.com/archive/1/499616/100/0/threaded · Note
• https://t.me/cvenotify/89612 · Telegram Post
• http://securityfocus.com/bid/32997 · Note
• http://securityfocus.com/archive/1/499581/100/0/threaded · Note