Lucene search

K
nessusThis script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.GOOGLE_CHROME_125_0_6422_60.NASL
HistoryMay 15, 2024 - 12:00 a.m.

Google Chrome < 125.0.6422.60 Multiple Vulnerabilities

2024-05-1500:00:00
This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
12
google chrome
vulnerabilities
version <125.0.6422.60
type confusion
use after free
inappropriate implementation

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.002

Percentile

61.3%

The version of Google Chrome installed on the remote Windows host is prior to 125.0.6422.60. It is, therefore, affected by multiple vulnerabilities as referenced in the 2024_05_stable-channel-update-for-desktop_15 advisory.

  • Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) (CVE-2024-4947)

  • Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-4948)

  • Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-4949)

  • Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (CVE-2024-4950)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(197086);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/27");

  script_cve_id(
    "CVE-2024-4947",
    "CVE-2024-4948",
    "CVE-2024-4949",
    "CVE-2024-4950"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/06/10");
  script_xref(name:"IAVA", value:"2024-A-0278-S");

  script_name(english:"Google Chrome < 125.0.6422.60 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote Windows host is prior to 125.0.6422.60. It is, therefore, affected
by multiple vulnerabilities as referenced in the 2024_05_stable-channel-update-for-desktop_15 advisory.

  - Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute
    arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
    (CVE-2024-4947)

  - Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-4948)

  - Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-4949)

  - Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote
    attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML
    page. (Chromium security severity: Low) (CVE-2024-4950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3df5e6e");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/340221135");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/333414294");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/326607001");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/40065403");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome version 125.0.6422.60 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-4947");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/05/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("google_chrome_installed.nasl", "smb_hotfixes.nasl");
  script_require_keys("SMB/Google_Chrome/Installed");

  exit(0);
}
include('google_chrome_version.inc');
include('smb_hotfixes.inc');

get_kb_item_or_exit('SMB/Google_Chrome/Installed');
var installs = get_kb_list('SMB/Google_Chrome/*');

if (hotfix_check_sp_range(win10:'0') <= 0)
  audit(AUDIT_OS_SP_NOT_VULN);

google_chrome_check_version(installs:installs, fix:'125.0.6422.60', severity:SECURITY_HOLE, xss:FALSE, xsrf:FALSE);
VendorProductVersionCPE
googlechromecpe:/a:google:chrome

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.002

Percentile

61.3%