#VU44147 Origin validation error in Google Chrome - CVE-2011-3067

Vulnerability identifier: #VU44147

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-3067

CWE-ID: CWE-346

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Google Chrome
Client/Desktop applications / Web browsers

Vendor: Google

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to replacement of IFRAME elements.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Google Chrome: 18.0.1025.0 - 18.0.1025.150

---

External links
https://code.google.com/p/chromium/issues/detail?id=117583
https://googlechromereleases.blogspot.com/2012/04/stable-and-beta-channel-updates.html
https://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
https://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
https://osvdb.org/81037
https://secunia.com/advisories/48732
https://secunia.com/advisories/48749
https://security.gentoo.org/glsa/glsa-201204-03.xml
https://support.apple.com/kb/HT5400
https://support.apple.com/kb/HT5503
https://www.securityfocus.com/bid/52913
https://www.securitytracker.com/id?1026892
https://exchange.xforce.ibmcloud.com/vulnerabilities/74627
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15342

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.