CVE-2014-3166

Sažetak

The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.

Reference

https://src.chromium.org/viewvc/chrome?revision=286598&view=revision
http://secunia.com/advisories/59693
http://www.ietf.org/mail-archive/web/tls/current/msg13345.html
http://googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html
http://secunia.com/advisories/59904
http://secunia.com/advisories/60685
https://src.chromium.org/viewvc/chrome?revision=288435&view=revision
http://security.gentoo.org/glsa/glsa-201408-16.xml
http://secunia.com/advisories/60798
https://code.google.com/p/chromium/issues/detail?id=398925
http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
http://www.securityfocus.com/bid/69202
http://www.debian.org/security/2014/dsa-3039
http://googlechromereleases.blogspot.com/2014/08/chrome-for-ios-update.html
http://www.securitytracker.com/id/1030732

CVSS

Base:	4.3
Impact:	2.9
Exploitability:	8.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	NONE

CVSS vektor

AV:N/AC:M/Au:N/C:P/I:N/A:N

Zadnje važnije ažuriranje

07-11-2023 - 02:19

Objavljeno

13-08-2014 - 04:57