PT-2017-16270 · Google+5 · Google Chrome+6

Published 2017-03-09 · Updated 2022-04-22 · CVE-2017-5033

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 57.0.2987.98 for Mac, Windows, and Linux Google Chrome version 57.0.2987.108 for Android

Description The issue is related to the incorrect propagation of Content Security Policy (CSP) restrictions to local scheme pages in Blink, which is used by Google Chrome and Opera. This allowed a remote attacker to bypass the content security policy via a crafted HTML page, specifically related to the unsafe-inline keyword. The vulnerability enables remote attackers to circumvent the restrictions imposed by the content security policy, potentially leading to security breaches.

Recommendations For Google Chrome versions prior to 57.0.2987.98 on Mac, Windows, and Linux, update to version 57.0.2987.98 or later. For Google Chrome version 57.0.2987.108 on Android, update to a version later than 57.0.2987.108. As a temporary workaround, consider restricting the use of the unsafe-inline keyword in Content Security Policy definitions until a patch is applied.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

ALT-PU-2017-1391

CVE-2017-5033

DSA-3810-1

MGASA-2017-0111

OPENSUSE-SU-2017:0738-1

OPENSUSE-SU-2017:0740-1

OPENSUSE-SU-2017_0738-1

RHSA-2017:0499

RHSA-2017_0499

USN-3236-1

Affected Products

Alt Linux

Blink

Google Chrome

Opera

Red Hat

Suse

Ubuntu

References · 56

• 🔥 http://blog.talosintelligence.com/2017/09/vulnerability-spotlight-content.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-5033 · Security Note
• https://osv.dev/vulnerability/USN-3236-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5044 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5033 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0499.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5033 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0740-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5031 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5045 · Vendor Advisory
• https://security.gentoo.org/glsa/201704-02 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5029 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5037 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5035 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5040 · Vendor Advisory