PT-2014-3158 · Google+1 · Google Chrome+1

Antoine Delignat-Lavaud + 1 · Published 2014-02-20 · Updated 2024-06-15 · CVE-2013-6659

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 33.0.1750.117

Description The issue concerns the SSLClientSocketNSS::Core::OwnAuthCertHandler function in Google Chrome, which does not prevent changes to server X.509 certificates during renegotiations. This allows remote SSL servers to trigger the use of a new certificate chain by initiating a TLS renegotiation, potentially inconsistent with the user's expectations.

Recommendations For versions prior to 33.0.1750.117, update to version 33.0.1750.117 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2014-1282

CVE-2013-6659

DSA-2883-1

MGASA-2014-0107

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Google Chrome

References · 2368

• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2014-1701 · Exploit
• https://errata.altlinux.org/ALT-PU-2014-1282 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6660 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6655 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6654 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1700 · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6656 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1703 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1702 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6661 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6668 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1704 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0107 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6666 · Security Note