PT-2016-3424 · Yandex · Yandex Browser

Published 2016-10-26 · Updated 2016-12-02 · CVE-2016-8503

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yandex Browser versions 16.7 through 16.9

Description The issue is related to the Yandex Protect Anti-phishing warning in Yandex Browser, which could be exploited by a remote attacker to brute-force passwords from important web resources using special JavaScript. The vulnerability is associated with errors in security settings, allowing a remote attacker to bypass existing security restrictions.

Recommendations For Yandex Browser versions 16.7 through 16.9, consider disabling the Anti-phishing function as a temporary workaround until a patch is available. Restrict access to sensitive web resources to minimize the risk of exploitation. Avoid using the browser for critical operations that involve sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2022-03573

CVE-2016-8503

Affected Products

Yandex Browser

References · 6

• https://bdu.fstec.ru/vul/2022-03573 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8503 · Security Note
• https://browser.yandex.com/security/changelogs · Vendor Advisory
• http://securityfocus.com/bid/93921 · Note
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Note