PT-2014-1375 · Google+2 · Google Chrome+2

Rob Wu · Published 2014-08-26 · Updated 2024-06-15 · CVE-2014-3170

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 37.0.2062.94

Description The issue exists due to the possibility of using the '0' character in host names, which allows remote attackers to spoof the extension permission dialog by relying on truncation after this character. This can be exploited by attackers to manipulate the dialog, potentially leading to unauthorized access or actions.

Recommendations For Google Chrome versions prior to 37.0.2062.94, update to version 37.0.2062.94 or later to resolve the issue. As a temporary workaround, consider restricting the use of extensions that rely on host names to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-2044

BDU:2015-00237

CVE-2014-3170

DSA-3039-1

OPENSUSE-SU-2014_1151-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Google Chrome

Suse

References · 2385

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2014-3176.md · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3174 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3169 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3171 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3168 · Security Note
• https://ubuntu.com/security/CVE-2014-3170 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00239 · Security Note
• http://debian.org/security/2014/dsa-3039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00192 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-2044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3170 · Security Note
• https://bdu.fstec.ru/vul/2015-00194 · Security Note
• https://bdu.fstec.ru/vul/2015-00242 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3177 · Security Note
• https://bdu.fstec.ru/vul/2015-00202 · Security Note