Vulnerability CVE-2011-3640
Published: 2011-10-27   Modified: 2012-02-13

Description:
** DISPUTED ** Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Google Chrome pkcs11.txt File Planting
acros
03.11.2011

Type:

CWE-Other

CVSS2 => (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.9/10
10/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Google -> Chrome 

 References:
https://bugzilla.mozilla.org/show_bug.cgi?id=641052
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13414
http://code.google.com/p/chromium/issues/detail?id=97426
http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.html
Copyright 2024, cxsecurity.com

 

Back to Top