PT-2009-6147 · Microsoft+2 · Internet Explorer+2
Infernosec
+1
·
Published
2009-11-12
·
Updated
2017-08-17
·
CVE-2009-3931
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 3.0.195.32
Description
The issue allows remote attackers to force the download of certain dangerous files via a "Content-Disposition: attachment" designation. This can be demonstrated by various file types, including .mht and .mhtml files, which are automatically executed by Internet Explorer 6, .svg files executed by Safari, and other file types such as .xml, .htt, .xsl, .xslt, and certain image files that are forbidden by the victim's site policy.
Recommendations
For versions prior to 3.0.195.32, update to version 3.0.195.32 or later to resolve the issue. As a temporary workaround, consider restricting the download of potentially dangerous file types to minimize the risk of exploitation. Avoid using the
Content-Disposition: attachment designation for files that could be automatically executed by other browsers, such as .mht, .mhtml, and .svg files, until the issue is resolved.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Google Chrome
Internet Explorer
Safari