The version of Microsoft Edge installed on the remote Windows host is prior to 88.0.705.74. It is, therefore, affected by multiple vulnerabilities as referenced in the February 17, 2021 advisory.
Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (CVE-2021-21149)
Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
(CVE-2021-21150)
Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21151)
Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21152)
Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21153)
Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
(CVE-2021-21154)
Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21155)
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted script. (CVE-2021-21156)
Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21157)
Note that Nessus has not tested for this issue but has instead relied only on the application’s self-reported version number.
##
# (C) Tenable Network Security, Inc.
##
include('compat.inc');
if (description)
{
script_id(146586);
script_version("1.7");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/05/10");
script_cve_id(
"CVE-2021-21149",
"CVE-2021-21150",
"CVE-2021-21151",
"CVE-2021-21152",
"CVE-2021-21153",
"CVE-2021-21154",
"CVE-2021-21155",
"CVE-2021-21156",
"CVE-2021-21157"
);
script_name(english:"Microsoft Edge (Chromium) < 88.0.705.74 Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote host has an web browser installed that is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The version of Microsoft Edge installed on the remote Windows host is prior to 88.0.705.74. It is, therefore, affected
by multiple vulnerabilities as referenced in the February 17, 2021 advisory.
- Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote
attacker to perform out of bounds memory access via a crafted HTML page. (CVE-2021-21149)
- Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker
who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
(CVE-2021-21150)
- Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to
potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21151)
- Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker
to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21152)
- Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote
attacker to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21153)
- Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who
had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
(CVE-2021-21154)
- Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote
attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted
HTML page. (CVE-2021-21155)
- Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to
potentially exploit heap corruption via a crafted script. (CVE-2021-21156)
- Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker
to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21157)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
# https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#february-17-2021
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?18ef2264");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21149");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21150");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21151");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21152");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21153");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21154");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21155");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21156");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21157");
script_set_attribute(attribute:"solution", value:
"Upgrade to Microsoft Edge version 88.0.705.74 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-21157");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2021-21155");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2021/02/09");
script_set_attribute(attribute:"patch_publication_date", value:"2021/02/17");
script_set_attribute(attribute:"plugin_publication_date", value:"2021/02/19");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:edge");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows");
script_copyright(english:"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("microsoft_edge_chromium_installed.nbin");
script_require_keys("installed_sw/Microsoft Edge (Chromium)", "SMB/Registry/Enumerated");
exit(0);
}
include('vcf.inc');
get_kb_item_or_exit('SMB/Registry/Enumerated');
app_info = vcf::get_app_info(app:'Microsoft Edge (Chromium)', win_local:TRUE);
constraints = [
{ 'fixed_version' : '88.0.705.74' }
];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21149
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21150
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21151
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21152
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21153
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21154
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21155
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21156
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21157
www.nessus.org/u?18ef2264
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21149
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21150
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21151
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21152
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21153
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21154
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21155
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21156
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21157