Home ▼ Bookkeeping
Online ▼ Security
Audits ▼
Managed
DNS ▼
About
Order
FAQ
Acceptable Use Policy
Dynamic DNS Clients
Configure Domains Dyanmic DNS Update Password Network
Monitor ▼
Enterprise Package
Advanced Package
Standard Package
Free Trial
FAQ
Price/Feature Summary
Order/Renew
Examples
Configure/Status Alert Profiles | |||
Test ID: | 1.3.6.1.4.1.25623.1.0.902615 |
Category: | General |
Title: | Google Chrome Secure Cookie Security Bypass Vulnerability (Linux) |
Summary: | The host is running Google Chrome and is prone to security bypass; vulnerability. |
Description: | Summary: The host is running Google Chrome and is prone to security bypass vulnerability. Vulnerability Insight: The flaw is due to improper restrictions for modifications to cookies established in HTTPS sessions i.e lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response. Vulnerability Impact: Successful exploitation will allow attackers to overwrite or delete arbitrary cookies by sending a specially crafted HTTP response through a man-in-the- middle attack. Affected Software/OS: Google Chrome version prior to 4.0.211.0 on Linux. Solution: Upgrade to the Google Chrome 4.0.211.0 or later. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P |
Cross-Ref: |
BugTraq ID: 49133 Common Vulnerability Exposure (CVE) ID: CVE-2008-7294 http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies http://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.html http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html http://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.html https://bugzilla.mozilla.org/show_bug.cgi?id=660053 http://lists.w3.org/Archives/Public/public-webapps/2009JulSep/1148.html |
Copyright | Copyright (C) 2011 Greenbone Networks GmbH |
This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below. |