Vulnerability CVE-2013-0924

Vulnerability Name:

CVE-2013-0924 (CCN-83075)

Assigned:

2013-03-26

Published:

2013-03-26

Updated:

2017-09-19

Summary:

The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Unknown

References:

Source: MITRE
Type: CNA
CVE-2013-0924

Source: CONFIRM
Type: Vendor Advisory
http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Update

Source: CCN
Type: SA52761
Google Chrome Multiple Vulnerabilities

Source: CCN
Type: BID-58733
Google Chrome Prior to 26.0.1410.43 CVE-2013-0924 Unspecified Security Vulnerability

Source: CONFIRM
Type: Issue Tracking, Patch
https://code.google.com/p/chromium/issues/detail?id=169632

Source: XF
Type: UNKNOWN
google-cve20130924-unspec(83075)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:16674

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-0924

Vulnerable Configuration:

Configuration 1:

cpe:/a:google:chrome:26.0.1410.0:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.1:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.2:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.3:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.4:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.5:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.6:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.7:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.8:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.9:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.10:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.11:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.12:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.14:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.15:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.16:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.17:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.18:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.19:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.20:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.21:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.22:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.23:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.24:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.25:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.26:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.27:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.28:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.29:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.30:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.31:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.32:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.33:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.34:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.35:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.36:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.37:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.38:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.39:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.40:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:26.0.1410.41:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version <= 26.0.1410.42)

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:16674	V	The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions	2013-08-12
oval:com.ubuntu.precise:def:20130924000	V	CVE-2013-0924 on Ubuntu 12.04 LTS (precise) - medium.	2013-03-28

BACK