Vulnerability CVE-2013-0921

Vulnerability Name:

CVE-2013-0921 (CCN-83072)

Assigned:

2013-03-26

Published:

2013-03-26

Updated:

2017-09-19

Summary:

The Isolated Sites feature in Google Chrome before 26.0.1410.43 does not properly enforce the use of separate processes, which makes it easier for remote attackers to bypass intended access restrictions via a crafted web site.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Unknown

References:

Source: MITRE
Type: CNA
CVE-2013-0921

Source: CONFIRM
Type: Vendor Advisory
http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Update

Source: CCN
Type: SA52761
Google Chrome Multiple Vulnerabilities

Source: CCN
Type: BID-58728
Google Chrome Prior to 26.0.1410.43 CVE-2013-0921 Unspecified Security Vulnerability

Source: CONFIRM
Type: Permissions Required
https://code.google.com/p/chromium/issues/detail?id=174943

Source: XF
Type: UNKNOWN
google-cve20130921-unspecified(83072)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:16670

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-0921

Vulnerable Configuration:

Configuration 1:

cpe:/a:google:chrome:26.0.1410.0:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.1:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.2:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.3:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.4:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.5:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.6:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.7:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.8:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.9:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.10:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.11:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.12:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.14:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.15:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.16:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.17:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.18:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.19:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.20:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.21:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.22:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.23:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.24:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.25:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.26:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.27:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.28:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.29:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.30:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.31:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.32:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.33:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.34:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.35:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.36:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.37:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.38:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.39:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.40:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.41:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version <= 26.0.1410.42)

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:16670	V	The Isolated Sites feature in Google Chrome before 26.0.1410.43 does not properly enforce the use of separate processes	2013-08-12
oval:com.ubuntu.precise:def:20130921000	V	CVE-2013-0921 on Ubuntu 12.04 LTS (precise) - medium.	2013-03-28

BACK