製品・ソフトウェアに関する情報

JVN脆弱性詳細

iOS 上で稼働する Google Chrome におけるデバイスからビデオおよびオーディオデータを取得される脆弱性

Title	iOS 上で稼働する Google Chrome におけるデバイスからビデオおよびオーディオデータを取得される脆弱性
Summary	iOS 上で稼働する Google Chrome は、(1) facetime:// および (2) facetime-audio:// URL の処理を適切に制限しないため、デバイスからビデオおよびオーディオデータを取得される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された Web サイトを介して、デバイスからビデオおよびオーディオデータを取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 7, 2014, midnight
Registration Date	Oct. 9, 2014, 4:19 p.m.
Last Update	Oct. 9, 2014, 4:19 p.m.

CVSS2.0 : 警告
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected System

アップル

iOS

Google

Google Chrome 37.0.2062.60 未満

Google Chrome 38.0.2125.59 未満の 38.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3187	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3187
National Vulnerability Database (NVD)
2	CVE-2014-3187	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3187

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Google
1	Chrome for iOS Update	http://googlechromereleases.blogspot.jp/2014/10/chrome-for-ios-update.html
2	Google Chrome	https://www.google.com/intl/ja/chrome/browser/features.html

Change Log

No	Changed Details	Date of change
0	[2014年10月09日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-3187

Summary	Google Chrome before 37.0.2062.60 and 38.x before 38.0.2125.59 on iOS does not properly restrict processing of (1) facetime:// and (2) facetime-audio:// URLs, which allows remote attackers to obtain video and audio data from a device via a crafted web site.
Publication Date	Oct. 8, 2014, 7:55 p.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:07 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome::::::::		37.0.2062.59
cpe:2.3:a:google:chrome:37.0.2062.0:::::::*
cpe:2.3:a:google:chrome:37.0.2062.1:::::::*
cpe:2.3:a:google:chrome:37.0.2062.2:::::::*
cpe:2.3:a:google:chrome:37.0.2062.3:::::::*
cpe:2.3:a:google:chrome:37.0.2062.4:::::::*
cpe:2.3:a:google:chrome:37.0.2062.5:::::::*
cpe:2.3:a:google:chrome:37.0.2062.6:::::::*
cpe:2.3:a:google:chrome:37.0.2062.10:::::::*
cpe:2.3:a:google:chrome:37.0.2062.11:::::::*
cpe:2.3:a:google:chrome:37.0.2062.12:::::::*
cpe:2.3:a:google:chrome:37.0.2062.13:::::::*
cpe:2.3:a:google:chrome:37.0.2062.14:::::::*
cpe:2.3:a:google:chrome:37.0.2062.15:::::::*
cpe:2.3:a:google:chrome:37.0.2062.16:::::::*
cpe:2.3:a:google:chrome:37.0.2062.17:::::::*
cpe:2.3:a:google:chrome:37.0.2062.18:::::::*
cpe:2.3:a:google:chrome:37.0.2062.19:::::::*
cpe:2.3:a:google:chrome:37.0.2062.20:::::::*
cpe:2.3:a:google:chrome:37.0.2062.21:::::::*
cpe:2.3:a:google:chrome:37.0.2062.22:::::::*
cpe:2.3:a:google:chrome:37.0.2062.23:::::::*
cpe:2.3:a:google:chrome:37.0.2062.24:::::::*
cpe:2.3:a:google:chrome:37.0.2062.25:::::::*
cpe:2.3:a:google:chrome:37.0.2062.26:::::::*
cpe:2.3:a:google:chrome:37.0.2062.27:::::::*
cpe:2.3:a:google:chrome:37.0.2062.28:::::::*
cpe:2.3:a:google:chrome:37.0.2062.29:::::::*
cpe:2.3:a:google:chrome:37.0.2062.30:::::::*
cpe:2.3:a:google:chrome:37.0.2062.31:::::::*
cpe:2.3:a:google:chrome:37.0.2062.32:::::::*
cpe:2.3:a:google:chrome:37.0.2062.33:::::::*
cpe:2.3:a:google:chrome:37.0.2062.34:::::::*
cpe:2.3:a:google:chrome:37.0.2062.35:::::::*
cpe:2.3:a:google:chrome:37.0.2062.36:::::::*
cpe:2.3:a:google:chrome:37.0.2062.37:::::::*
cpe:2.3:a:google:chrome:37.0.2062.39:::::::*
cpe:2.3:a:google:chrome:37.0.2062.43:::::::*
cpe:2.3:a:google:chrome:37.0.2062.44:::::::*
cpe:2.3:a:google:chrome:37.0.2062.45:::::::*
cpe:2.3:a:google:chrome:37.0.2062.46:::::::*
cpe:2.3:a:google:chrome:37.0.2062.47:::::::*
cpe:2.3:a:google:chrome:37.0.2062.48:::::::*
cpe:2.3:a:google:chrome:37.0.2062.49:::::::*
cpe:2.3:a:google:chrome:37.0.2062.50:::::::*
cpe:2.3:a:google:chrome:37.0.2062.51:::::::*
cpe:2.3:a:google:chrome:37.0.2062.52:::::::*
cpe:2.3:a:google:chrome:37.0.2062.53:::::::*
cpe:2.3:a:google:chrome:37.0.2062.54:::::::*
cpe:2.3:a:google:chrome:37.0.2062.55:::::::*
cpe:2.3:a:google:chrome:37.0.2062.56:::::::*
cpe:2.3:a:google:chrome:37.0.2062.57:::::::*
cpe:2.3:a:google:chrome:37.0.2062.58:::::::*
cpe:2.3:a:google:chrome:38.0.2125.7:::::::*
cpe:2.3:o:apple:iphone_os:-:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://googlechromereleases.blogspot.com/2014/10/chrome-for-ios-update.html
2	http://googlechromereleases.blogspot.com/2014/10/chrome-for-ios-update.html
3	http://twitter.com/S9Labs/statuses/519576582742999043
4	http://twitter.com/S9Labs/statuses/519576582742999043
5	https://code.google.com/p/chromium/issues/detail?id=413831
6	https://code.google.com/p/chromium/issues/detail?id=413831
7	https://medium.com/section-9-lab/abusing-ios-url-handlers-on-messages-96979e8b12f5
8	https://medium.com/section-9-lab/abusing-ios-url-handlers-on-messages-96979e8b12f5

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome::::::::		37.0.2062.59
cpe:2.3:a:google:chrome:37.0.2062.0:::::::*
cpe:2.3:a:google:chrome:37.0.2062.1:::::::*
cpe:2.3:a:google:chrome:37.0.2062.2:::::::*
cpe:2.3:a:google:chrome:37.0.2062.3:::::::*
cpe:2.3:a:google:chrome:37.0.2062.4:::::::*
cpe:2.3:a:google:chrome:37.0.2062.5:::::::*
cpe:2.3:a:google:chrome:37.0.2062.6:::::::*
cpe:2.3:a:google:chrome:37.0.2062.10:::::::*
cpe:2.3:a:google:chrome:37.0.2062.11:::::::*
cpe:2.3:a:google:chrome:37.0.2062.12:::::::*
cpe:2.3:a:google:chrome:37.0.2062.13:::::::*
cpe:2.3:a:google:chrome:37.0.2062.14:::::::*
cpe:2.3:a:google:chrome:37.0.2062.15:::::::*
cpe:2.3:a:google:chrome:37.0.2062.16:::::::*
cpe:2.3:a:google:chrome:37.0.2062.17:::::::*
cpe:2.3:a:google:chrome:37.0.2062.18:::::::*
cpe:2.3:a:google:chrome:37.0.2062.19:::::::*
cpe:2.3:a:google:chrome:37.0.2062.20:::::::*
cpe:2.3:a:google:chrome:37.0.2062.21:::::::*
cpe:2.3:a:google:chrome:37.0.2062.22:::::::*
cpe:2.3:a:google:chrome:37.0.2062.23:::::::*
cpe:2.3:a:google:chrome:37.0.2062.24:::::::*
cpe:2.3:a:google:chrome:37.0.2062.25:::::::*
cpe:2.3:a:google:chrome:37.0.2062.26:::::::*
cpe:2.3:a:google:chrome:37.0.2062.27:::::::*
cpe:2.3:a:google:chrome:37.0.2062.28:::::::*
cpe:2.3:a:google:chrome:37.0.2062.29:::::::*
cpe:2.3:a:google:chrome:37.0.2062.30:::::::*
cpe:2.3:a:google:chrome:37.0.2062.31:::::::*
cpe:2.3:a:google:chrome:37.0.2062.32:::::::*
cpe:2.3:a:google:chrome:37.0.2062.33:::::::*
cpe:2.3:a:google:chrome:37.0.2062.34:::::::*
cpe:2.3:a:google:chrome:37.0.2062.35:::::::*
cpe:2.3:a:google:chrome:37.0.2062.36:::::::*
cpe:2.3:a:google:chrome:37.0.2062.37:::::::*
cpe:2.3:a:google:chrome:37.0.2062.39:::::::*
cpe:2.3:a:google:chrome:37.0.2062.43:::::::*
cpe:2.3:a:google:chrome:37.0.2062.44:::::::*
cpe:2.3:a:google:chrome:37.0.2062.45:::::::*
cpe:2.3:a:google:chrome:37.0.2062.46:::::::*
cpe:2.3:a:google:chrome:37.0.2062.47:::::::*
cpe:2.3:a:google:chrome:37.0.2062.48:::::::*
cpe:2.3:a:google:chrome:37.0.2062.49:::::::*
cpe:2.3:a:google:chrome:37.0.2062.50:::::::*
cpe:2.3:a:google:chrome:37.0.2062.51:::::::*
cpe:2.3:a:google:chrome:37.0.2062.52:::::::*
cpe:2.3:a:google:chrome:37.0.2062.53:::::::*
cpe:2.3:a:google:chrome:37.0.2062.54:::::::*
cpe:2.3:a:google:chrome:37.0.2062.55:::::::*
cpe:2.3:a:google:chrome:37.0.2062.56:::::::*
cpe:2.3:a:google:chrome:37.0.2062.57:::::::*
cpe:2.3:a:google:chrome:37.0.2062.58:::::::*
cpe:2.3:a:google:chrome:38.0.2125.7:::::::*
cpe:2.3:o:apple:iphone_os:-:::::::*