Vulnerability ID 5611

Google Chrome up to 19.0.1084.57 on Linux 64-bit XML libxml buffer overflow

Google
CVSSv3 Temp ScoreCurrent Exploit Price (≈)
7.0$5k-$10k

A vulnerability has been found in Google Chrome up to 19.0.1084.57 on Linux 64-bit and classified as critical. Affected by this vulnerability is an unknown function in the library libxml of the component XML. The manipulation with an unknown input leads to a buffer overflow vulnerability. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was released 06/26/2012 by Jüri Aedla with Google Chrome Security Team as 129930. The advisory is shared for download at code.google.com. The public release was coordinated with Google. This vulnerability is known as CVE-2012-2807 since 05/19/2012. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.

We expect the 0-day to have been worth approximately $50k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 74660 (openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0813-1)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and relying on port 0.

Upgrading to version 20.0.1132.43 eliminates this vulnerability. The upgrade is hosted for download at google.com. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.gnome.org. The problem might be mitigated by replacing the product with Mozilla Firefox, Microsoft Internet Explorer, Opera as an alternative. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at SecurityFocus (BID 54718) and Secunia (SA49724). Additional details are provided at googlechromereleases.blogspot.de. See 5585, 5586, 5587 and 5588 for similar entries.

CVSSv3

Base Score: 7.3 [?]
Temp Score: 7.0 [?]
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C [?]
Reliability: High

CVSSv2

Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 5.9 (CVSS2#E:ND/RL:OF/RC:C) [?]
Reliability: High

AVACAuCIA
LHMNNN
AMSPPP
NLNCCC
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
LocalHighMultipleNoneNoneNone
AdjacentMediumSinglePartialPartialPartial
NetworkLowNoneCompleteCompleteComplete

CPE

Exploiting

Class: Buffer overflow (CWE-189)
Local: No
Remote: Yes

Availability: No
Access: Public

Current Price Estimation: $50k-$100k (0-day) / $5k-$10k (Today)

0-Day$0-$1k$1k-$2k$2k-$5k$5k-$10k$10k-$25k$25k-$50k$50k-$100k$100k-$500k
Today$0-$1k$1k-$2k$2k-$5k$5k-$10k$10k-$25k$25k-$50k$50k-$100k$100k-$500k


Nessus ID: 74660
Nessus Name: openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0813-1)
Nessus File: ala_ALAS-2012-134.nasl
Nessus Family: SuSE Local Security Checks
Nessus Port: 0
OpenVAS ID: 71498
OpenVAS Name: Debian Security Advisory DSA 2521-1 (libxml2)
OpenVAS File: deb_2521_1.nasl
OpenVAS Family: Debian Local Security Checks

Countermeasures

Recommended: Upgrade
Status: Official fix
Reaction Time: 0 days since reported
0-Day Time: 0 days since found
Exposure Time: 0 days since known

Upgrade: Chrome 20.0.1132.43
Patch: git.gnome.org
Alternative: Mozilla Firefox, Microsoft Internet Explorer, Opera

Timeline

05/19/2012 CVE assigned
06/26/2012 +39 days Vendor acknowledged
06/26/2012 +0 days Advisory disclosed
06/26/2012 +0 days Countermeasure disclosed
06/27/2012 +0 days VulDB entry created
06/27/2012 +0 days NVD disclosed
06/27/2012 +0 days OSVDB entry created
06/13/2014 +716 days Nessus plugin released
07/03/2015 +385 days VulDB entry updated

Sources

Advisory: 129930
Researcher: Jüri Aedla
Organization: Google Chrome Security Team
Status: Confirmed
Confirmation: code.google.com
Coordinated: Yes

CVE: CVE-2012-2807 (mitre.org) (nvd.nist.org) (cvedetails.com)

SecurityFocus: 54718 - libxml2 CVE-2012-2807 Multiple Integer Overflow Vulnerabilities
Secunia: 49724 - Google Chrome Multiple Vulnerabilities, Highly Critical
OSVDB: 83266 - Libxml2 for 64-bit Linux Multiple Integer Overflow Issues

Misc.: googlechromereleases.blogspot.de
See also: 5585, 5586, 5587, 5588, 5589, 5591, 5592, 5593, 5598, 5599, 5600, 5601, 5602, 5603

Entry

Created: 06/27/2012
Updated: 07/03/2015
Entry: 93.9% complete