May 25, 2013

You are here: Home / Archives for Google

Google fixes three High risk security bugs in Chrome 24.0.1312.56

January 23, 2013 by

Chrome-logo-2011-03-16(LiveHacking.Com) – Google has released Chrome 24.0.1312.56 with several important bug fixes along with five security related changes to patch vulnerabilities in the browser. Among the bug fixes are changes to improve mouse wheel scrolling performance and improvements to the installation process when the browser is installed as admin on Windows.

On the security side, Google paid out a $1000 reward to Atte Kettunen of OUSPG for finding a High priority use-after-free bug in the canvas font handling. Google considers a vulnerability High risk if it could could let an attacker read or modify confidential data belonging to other web sites. Also vulnerabilities that interfere with browser security features are also considered to have a high severity.

There were a further two High severity vulnerabilities fixed, both of which were found by employees of Google. The first was an unchecked array index in content blocking that was discovered by Chris Evans. The second was a crash that occurred with an unsupported RTC sampling rate. This Mac only vulnerability was found by Ted Nakamura.

 

Filed Under: Chrome, Google, News Tagged With: ,

Chrome 24 released with new version of Flash and a $4000 bug fix

January 11, 2013 by

Chrome-logo-2011-03-16(LiveHacking.Com) –  Google has released Chrome 24  with support for MathML, a new version of Adobe Flash Player, fixes for various security issues in V8 (v8-3.14.5.3) and $6000 worth of High priority security fixes.

First, Adobe released a new version of Adobe Flash Player this week and Microsoft subsequently updated IE 10 to upgrade its built-in Flash Player. Google normally do the same thing and as expected Chrome 24 contains the latest Flash Player with the security fixes issued by Adobe.

Also, Google fixed some High priority security bugs. It paid security researchers over $6000 for their effort. Erling A Ellingsen and Subodh Iyengar, both of Facebook, got to share $4000 between them for a same origin policy bypass when using a malformed URL bug. The full list of rewards is:

  • [$1000] [162494] High CVE-2012-5145: Use-after-free in SVG layout. Credit to Atte Kettunen of OUSPG.
  • [$4000] [165622] High CVE-2012-5146: Same origin policy bypass with malformed URL. Credit to Erling A Ellingsen and Subodh Iyengar, both of Facebook.
  • [$1000] [165864] High CVE-2012-5147: Use-after-free in DOM handling. Credit to José A. Vázquez.

Google also fixed a number of other security related bugs which were found by Google’s Chrome Security Team:

  • [167122] Medium CVE-2012-5148: Missing filename sanitization in hyphenation support. Credit to Google Chrome Security Team (Justin Schuh).
  • [166795] High CVE-2012-5149: Integer overflow in audio IPC handling. Credit to Google Chrome Security Team (Chris Evans).
  • [165601] High CVE-2012-5150: Use-after-free when seeking video. Credit to Google Chrome Security Team (Inferno).
  • [165538] High CVE-2012-5151: Integer overflow in PDF JavaScript. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
  • [165430] Medium CVE-2012-5152: Out-of-bounds read when seeking video. Credit to Google Chrome Security Team (Inferno).
  • [164565] High CVE-2012-5153: Out-of-bounds stack access in v8. Credit to Andreas Rossberg of the Chromium development community.
  • [Windows only] [164490] Low CVE-2012-5154: Integer overflow in shared memory allocation. Credit to Google Chrome Security Team (Chris Evans).
  • [Mac only] [163208] Medium CVE-2012-5155: Missing Mac sandbox for worker processes. Credit to Google Chrome Security Team (Julien Tinnes).
  • [162778] High CVE-2012-5156: Use-after-free in PDF fields. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
  • [162776] [162156] Medium CVE-2012-5157: Out-of-bounds reads in PDF image handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
  • [162153] High CVE-2013-0828: Bad cast in PDF root handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
  • [162114] High CVE-2013-0829: Corruption of database metadata leading to incorrect file access. Credit to Google Chrome Security Team (Jüri Aedla).
  • [Windows only] [162066] Low CVE-2013-0830: Missing NUL termination in IPC. Credit to Google Chrome Security Team (Justin Schuh).
  • [161836] Low CVE-2013-0831: Possible path traversal from extension process. Credit to Google Chrome Security Team (Tom Sepez).
  • [160380] Medium CVE-2013-0832: Use-after-free with printing. Credit to Google Chrome Security Team (Cris Neckar).
  • [154485] Medium CVE-2013-0833: Out-of-bounds read with printing. Credit to Google Chrome Security Team (Cris Neckar).
  • [154283] Medium CVE-2013-0834: Out-of-bounds read with glyph handling. Credit to Google Chrome Security Team (Cris Neckar).
  • [152921] Low CVE-2013-0835: Browser crash with geolocation. Credit to Arthur Gerkis.
  • [150545] High CVE-2013-0836: Crash in v8 garbage collection. Credit to Google Chrome Security Team (Cris Neckar).
  • [145363] Medium CVE-2013-0837: Crash in extension tab handling. Credit to Tom Nielsen.
  • [Linux only] [143859] Low CVE-2013-0838: Tighten permissions on shared memory segments. Credit to Google Chrome Security Team (Chris Palmer).

 

Filed Under: Google, News Tagged With: , , ,

In Brief: Microsoft, Google and Mozilla all block digital certificate issued by intermediate certificate authority of TURKTRUST

January 4, 2013 by

turktrust_logo(LiveHacking.Com) –  Microsoft, Google and Mozilla have all removed the trust of certificates issued by an intermediate certificate authority (CA) linking back to TURKTRUST Inc. What has happened is that TURKTRUST Inc. incorrectly created two subsidiary CAs (*.EGO.GOV.TR and e-islem.kktcmerkezbankasi.org), the first of which was used to issue a fraudulent digital certificate for *.google.com.

Intermediate CA certificates carry the same authority as CA, so anyone who has one can use it to create a certificate for any website. Fraudulent certificate can be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks.

“TURKTRUST told us that based on our information, they discovered that, in August 2011, they had mistakenly issued two intermediate CA certificates to organizations that should have instead received regular SSL certificates,” wrote Google.

Google is also considering an update to Chrome which will no longer indicate Extended Validation status for certificates issued by TURKTRUST. Mozilla has suspended the TURKTRUST root certificate. TURKTRUST subsequently asked Mozilla to include a newer root certificate and their request was initially approved. However, due to the mis-issued  intermediate CA certificates, Mozilla has decided to suspend inclusion of the new root certificate for now.

Filed Under: Cryptography, Google, Microsoft, Mozilla, News, Security Tagged With: , , , ,

In Brief: Google releases Chrome 23.0.1271.95 and gives Pinkie Pie $7331

November 30, 2012 by

(LiveHacking.Com) –  Google has released a new version of its Chrome browser (23.0.1271.95) just three days after releasing the previous version. This new update is a purely security related release and it fixes two high rated security vulnerabilities.

In Google speak, High means that the vulnerability could let an attacker read or modify confidential data belonging to other web sites. Also vulnerabilities that interfere with browser security features are also high severity.

The first vulnerability fixed, found by Jüri Aedla of the Google Chrome Security Team, was a bug in file path handling. The second, found by Pinkie Pie, was a use-after-free in media source handling. Pinkie Pie’s bug earned the researcher $7331.

Filed Under: Chrome, Chrome, Google, News, Vulnerability Tagged With: , , ,

Chrome 23.0.1271.91 fixes some High risk security vulnerabilities but nothing Critical

November 27, 2012 by

(LiveHacking.Com) – Google has released Chrome 23.0.1271.91 for Windows, Mac and Linux. The release fixes several bugs including an audio problem with Flash when the speaker configuration was set to Quadraphonic, however more importantly it fixes several High risk security vulnerabilities, but nothing ranked as Critical.

This release fixes three vulnerabilities with the  High rating. High in this context means that the vulnerability could let an attacker read or modify confidential data belonging to other web sites. Also vulnerabilities that interfere with browser security features are also high severity.

Under the Chromium security rewards scheme, Justin Drake was given a special reward for finding a bug in OS X which was sufficiently severe or particularly hard to workaround that it affects Chrome indirectly. In this case the High level vulnerability was a connected with a corrupt rendering in the Apple OSX driver for Intel GPUs.

Miaubiz was also hard at work and is credited with finding a High risk use-after-free bug in the SVG filters. Use-after-free bugs are good potential candidates for a full exploit. The other High rated vulnerability was a buffer underflow in libxml. The credit for fining that one goes to Jüri Aedla of the Google Chrome Security Team.

The full list of bugs is as follows:

  • [$1000] [152746] High CVE-2012-5131: Corrupt rendering in the Apple OSX driver for Intel GPUs. Credit to Justin Drake.
  • [$1000] [156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit to miaubiz.
  • [$500] [148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
  • [155711] Low CVE-2012-5132: Browser crash with chunked encoding. Credit to Attila Szász.
  • [158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to Google Chrome Security Team (Jüri Aedla).
  • [159165] Medium CVE-2012-5135: Use-after-free with printing. Credit to Fermin Serna of Google Security Team.
  • [159829] Medium CVE-2012-5136: Bad cast in input element handling. Credit to Google Chrome Security Team (Inferno).

It is worth noting that Google keep the referenced bugs private until a majority of Chrome users are up to date with the fixes.

Filed Under: Chrome, Google, News Tagged With: , , ,

Google releases Chrome 23 with some unique security bug fixes

November 7, 2012 by

(LiveHacking.Com) – Google has released Chrome 23 with some new features, like the option to send a ‘do not track’ request to websites, as well as some interesting security fixes. A “normal” Chrome update includes a variety of bug fixes found by Google itself and by outside security researchers who are reward (in cash) by Google for their efforts. However this time things are slight different.

First of all Google has issued a special reward to  miaubiz for non-Chrome related bug which is very severe and/or Google are able to partially work around the issue. In this case it was a way to defend against wild writes in buggy graphics drivers on Mac OS X. miaubiz got $1000 for his efforts!

This then also led to another $1000 for miaubiz for an integer bounds check issue in GPU command buffers, again only on Mac OS X.

Finally there is a out-of-bounds array access bug in v8 which was found by Atte Kettunen of OUSPG. This particular bug only affected Linux 64-bit systems only.

For the rest it was security bug squashing as normal:

  • [$3500] [157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.
  • [$1000] [143761] High CVE-2012-5116: Use-after-free in SVG filter handling. Credit to miaubiz.
  • [$1000] [154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.
  • [145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Gröbert of the Google Security Team.
  • [149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.
  • [154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).
  • [154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia. Credit to Google Chrome Security Team (Inferno).
  • [155323] High CVE-2012-5124: Memory corruption in texture handling. Credit to Al Patrick of the Chromium development community.
  • [156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.
  • [156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).
  • [157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).

Since adobe has released a new version of its ubiquitous Flash Player to address vulnerabilities that could cause a crash and potentially be exploited by an attacker to infect a PC with malware, Chrome 23 includes the updates version of Flash Player.

Filed Under: Chrome, Chrome, Google, News, Vulnerability Tagged With: , ,

Google updates Chrome after successful exploit at Pwnium 2

October 11, 2012 by

(LiveHacking.Com) – Google has released a rapid update to its Chrome web browser after it was successfully exploited at the Google run Pwnium 2 hacking competition. Chrome 22.0.1229.94, which is available for Windows, Mac, and Linux, fixes a SVG use-after-free and IPC arbitrary file write bug that was successfully used by Pinkie Pie to fully exploit Chrome. The prize money was $60,000 which is the top amount awarded for a full Chrome exploit on a fully patched Windows 7  PC using only bugs in Chrome itself.

“We’re delighted at the success of Pwnium 2, and anticipate additional hardening and future improvements to Chrome as a result of the competition,” wrote Jason Kersey from Google’s Chrome team.

The official bug list is as follows:

  • [$60,000][154983][154987] Critical CVE-2012-5112: SVG use-after-free and IPC arbitrary file write. Credit to Pinkie Pie.

PinkiePie (aka PwniePie) is no stranger to exploiting Chrome. Back in March he also received $60,000 after successfully demonstrating an exploit at the first Pwnium competition. Shortly after Google issued 17.0.963.79 to fix the vulnerability used. At the time, Jason Kersey from the Google Chrome team is quoted as calling the exploit “a beautiful piece of work.”

Filed Under: Chrome, Google Tagged With: , ,

Google updates Chrome to fix Critical security vulnerability in audio device handling

October 9, 2012 by

(LiveHacking.Com) – Google has released Chrome 22.0.1229.92 to fix several security related bugs, including a Critical security vulnerability in its audio device handling, and to update the built-in Adobe Flash player. Google paid out over $4000 to Atte Kettunen of OUSPG for his help in finding the audio related bug and a crash in Skia text rendering.

The list of security fixes are:

[$1000] [138208] High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG.
[$3133.7] [147499] Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG.
[$500] [148692] Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthur Gerkis.
[151449] Medium CVE-2012-5110: Out-of-bounds read in compositor. Credit to Google Chrome Security Team (Inferno).
[151895] Low CVE-2012-5111: Plug-in crash monitoring was missing for Pepper plug-ins. Credit to Google Chrome Security Team (Chris Evans).

It is worth noting that Google keep the referenced bugs private until a majority of Chrome users are up to date with the fixes.

Also included in Chrome 22.0.1229.92 is the latest version of the Adobe Flash Player which was just updated to address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system. The new versions in Chrome are 11.4.31.110 for Windows and Linux, and 11.4.402.287 for Macintosh.

Filed Under: Chrome, Chrome, Google, Vulnerability Tagged With: ,

Google releases Chrome 22 with $28,500 worth of security fixes and a workaround for a Windows kernel memory corruption

September 26, 2012 by

(LiveHacking.Com) – Google has released Chrome 22 with a variety of new features including a new Mouse Lock API (used mainly by 3D games) and some very important security fixes including a Critical level fix for a Windows kernel memory corruption. Under its reward scheme, which pays security researchers real money for their efforts in finding vulnerabilities in Chrome, Google paid out $28500 for vulnerabilities fixed in Chrome 22, one of which (the Windows kernel memory corruption) was award $10,000 while two UXSS  vulnerabilities earned Sergey Glazunov $15,000.

There are no details yet on the Windows kernel memory corruption or the nature of the Universal XSS flaws as Google (wisely) keeps the bug details private until a majority of users have updated. The Critical flaw in Windows (146254 / CVE-2012-2897) is credited to Eetu Luodemaa and Joni Vähämäki, both from Documill.

The UXSS errors are rated has High:

  • [143439] High CVE-2012-2889: UXSS in frame handling. Credit to Sergey Glazunov.
  • [143437] High CVE-2012-2886: UXSS in v8 bindings. Credit to Sergey Glazunov.

Other security related bugs fixed (along with the related rewards) are:

  • [$2000] [139814] High CVE-2012-2881: DOM tree corruption with plug-ins. Credit to Chamal de Silva.
  • [$1000] [135432] High CVE-2012-2876: Buffer overflow in SSE2 optimizations. Credit to Atte Kettunen of OUSPG.
  • [$1000] [140803] High CVE-2012-2883: Out-of-bounds write in Skia. Credit to Atte Kettunen of OUSPG.
  • [$1000] [143609] High CVE-2012-2887: Use-after-free in onclick handling. Credit to Atte Kettunen of OUSPG.
  • [$1000] [143656] High CVE-2012-2888: Use-after-free in SVG text references. Credit to miaubiz.
  • [$1000] [144899] High CVE-2012-2894: Crash in graphics context handling. Credit to Sławomir Błażek.
  • [Mac only] [$1000] [145544] High CVE-2012-2896: Integer overflow in WebGL. Credit to miaubiz.
  • [$500] [137707] Medium CVE-2012-2877: Browser crash with extensions and modal dialogs. Credit to Nir Moshe.
  • [$500] [139168] Low CVE-2012-2879: DOM topology corruption. Credit to pawlkt.
  • [$500] [141651] Medium CVE-2012-2884: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
  • [132398] High CVE-2012-2874: Out-of-bounds write in Skia. Credit to Google Chrome Security Team (Inferno).
  • [134955] [135488] [137106] [137288] [137302] [137547] [137556] [137606] [137635] [137880] [137928] [144579] [145079] [145121] [145163] [146462] Medium CVE-2012-2875: Various lower severity issues in the PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
  • [137852] High CVE-2012-2878: Use-after-free in plug-in handling. Credit to Fermin Serna of Google Security Team.
  • [139462] Medium CVE-2012-2880: Race condition in plug-in paint buffer. Credit to Google Chrome Security Team (Cris Neckar).
  • [140647] High CVE-2012-2882: Wild pointer in OGG container handling. Credit to Google Chrome Security Team (Inferno).
  • [142310] Medium CVE-2012-2885: Possible double free on exit. Credit to the Chromium development community.
  • [143798] [144072] [147402] High CVE-2012-2890: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
  • [144051] Low CVE-2012-2891: Address leak over IPC. Credit to Lei Zhang of the Chromium development community.
  • [144704] Low CVE-2012-2892: Pop-up block bypass. Credit to Google Chrome Security Team (Cris Neckar).
  • [144799] High CVE-2012-2893: Double free in XSL transforms. Credit to Google Chrome Security Team (Cris Neckar).
  • [145029] [145157] [146460] High CVE-2012-2895: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

The new mouse lock API included in Chrome 22 allows 3D applications, such as first-person games, to offer users control of the in-game 3D perspective using the mouse, without moving outside the window or bumping into the edge of their screen. Google recommends this first-person shooter demo created by Mozilla.

Filed Under: Chrome, Chrome, Google, Vulnerability Tagged With: , , ,

In brief: Google Go language used to write malware

September 25, 2012 by

(LiveHacking.Com) – Google Go, a compiled, concurrent programming language developed by Google, has been used for the first time to write malware. The language, which was initially released in 2009 and has been growing in popularity ever since, is a viable alternative to C or C++ and is good for writing low level and sever type software. This has now been proved in a way that maybe Google didn’t want. According to Symantec a malware has been found in the wild with components which are written in Go. The Trojan, known as Trojan.Encriyoko, attempts to encrypt various file formats on a compromised computer and so render them unusable.

The original sample Symantec acquired was called GalaxyNxRoot.exe, a dropper written in .NET which disguises itself as a rooting tool to trick users into installing it. When run GalaxyNxRoot.exe drops and launches two executable files, both written in Go: PPSAP.exe and adbtool.exe. The first is an information-stealing Trojan that collects system information such as current running processes, user name, MAC address, etc., and sends it to a server on the Internet. The second file downloads an encrypted file from a different remote location. This downloaded file is decryped and executed in a attempt to encrypt various files on the infected computer.

Filed Under: Google Tagged With: ,
«Older Posts