製品・ソフトウェアに関する情報

JVN脆弱性詳細

Google Chrome の getSVGDocument メソッドにおけるクロスサイトスクリプティングの脆弱性

タイトル	Google Chrome の getSVGDocument メソッドにおけるクロスサイトスクリプティングの脆弱性
概要	Google Chrome の getSVGDocument メソッドには、SVG ドキュメントをホストする Web サーバに関する処理に不備があり、"access check" を省いてしまうため、同一生成元ポリシーを回避され、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。
想定される影響	リモート Web サーバーにより、同一生成元ポリシーを回避され、クロスサイトスクリプティング攻撃を実行される可能性があります。
対策	ベンダ情報及び参考情報を参照して適切な対策を実施してください。
公表日	2009年9月15日0:00
登録日	2010年10月19日15:00
最終更新日	2010年10月19日15:00

CVSS2.0 : 警告
スコア	4.3
ベクター	AV:N/AC:M/Au:N/C:N/I:P/A:N

影響を受けるシステム

Google

Google Chrome 3.0.195.21 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-3264	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3264
National Vulnerability Database (NVD)
2	CVE-2009-3264	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3264

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	名前	URL
Google
1	Google Chrome	http://www.google.com/chrome/intl/ja/landing.html?hl=ja
2	stable-channel-update	http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html

その他

No	名前	URL
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
1	58193	http://osvdb.org/58193
Secunia Advisory
2	SA36770	http://secunia.com/advisories/36770
SecurityFocus
3	36416	http://www.securityfocus.com/bid/36416

変更履歴

No	変更内容	変更日
0	[2010年10月19日] 掲載	2018年2月17日10:37

NVD脆弱性情報

CVE-2009-3264

概要	The getSVGDocument method in Google Chrome before 3.0.195.21 omits an unspecified "access check," which allows remote web servers to bypass the Same Origin Policy and conduct cross-site scripting attacks via unknown vectors, related to a user's visit to a different web server that hosts an SVG document.
公表日	2009年9月19日7:30
登録日	2021年1月29日13:23
最終更新日	2009年10月1日14:24

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:google:chrome:0.2.149.27:::::::*
cpe:2.3:a:google:chrome:0.2.149.29:::::::*
cpe:2.3:a:google:chrome:0.2.149.30:::::::*
cpe:2.3:a:google:chrome:0.2.152.1:::::::*
cpe:2.3:a:google:chrome:0.2.153.1:::::::*
cpe:2.3:a:google:chrome:0.3.154.0:::::::*
cpe:2.3:a:google:chrome:0.3.154.3:::::::*
cpe:2.3:a:google:chrome:0.4.154.18:::::::*
cpe:2.3:a:google:chrome:0.4.154.22:::::::*
cpe:2.3:a:google:chrome:0.4.154.31:::::::*
cpe:2.3:a:google:chrome:0.4.154.33:::::::*
cpe:2.3:a:google:chrome:1.0.154.36:::::::*
cpe:2.3:a:google:chrome:1.0.154.39:::::::*
cpe:2.3:a:google:chrome:1.0.154.42:::::::*
cpe:2.3:a:google:chrome:1.0.154.43:::::::*
cpe:2.3:a:google:chrome:1.0.154.46:::::::*
cpe:2.3:a:google:chrome:1.0.154.48:::::::*
cpe:2.3:a:google:chrome:1.0.154.52:::::::*
cpe:2.3:a:google:chrome:1.0.154.53:::::::*
cpe:2.3:a:google:chrome:1.0.154.59:::::::*
cpe:2.3:a:google:chrome:1.0.154.65:::::::*
cpe:2.3:a:google:chrome:2.0.156.1:::::::*
cpe:2.3:a:google:chrome:2.0.157.0:::::::*
cpe:2.3:a:google:chrome:2.0.157.2:::::::*
cpe:2.3:a:google:chrome:2.0.158.0:::::::*
cpe:2.3:a:google:chrome:2.0.159.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.1:::::::*
cpe:2.3:a:google:chrome:2.0.170.0:::::::*
cpe:2.3:a:google:chrome:2.0.172:::::::*
cpe:2.3:a:google:chrome:2.0.172.2:::::::*
cpe:2.3:a:google:chrome:2.0.172.8:::::::*
cpe:2.3:a:google:chrome:2.0.172.27:::::::*
cpe:2.3:a:google:chrome:2.0.172.28:::::::*
cpe:2.3:a:google:chrome:2.0.172.30:::::::*
cpe:2.3:a:google:chrome:2.0.172.31:::::::*
cpe:2.3:a:google:chrome:2.0.172.33:::::::*
cpe:2.3:a:google:chrome:2.0.172.37:::::::*
cpe:2.3:a:google:chrome:2.0.172.38:::::::*
cpe:2.3:a:google:chrome:3.0.182.2:::::::*
cpe:2.3:a:google:chrome:3.0.190.2:::::::*
cpe:2.3:a:google:chrome::beta::::::*		3.0.193.2

構成1	以上	以下	より上	未満
cpe:2.3:a:google:chrome:0.2.149.27:::::::*
cpe:2.3:a:google:chrome:0.2.149.29:::::::*
cpe:2.3:a:google:chrome:0.2.149.30:::::::*
cpe:2.3:a:google:chrome:0.2.152.1:::::::*
cpe:2.3:a:google:chrome:0.2.153.1:::::::*
cpe:2.3:a:google:chrome:0.3.154.0:::::::*
cpe:2.3:a:google:chrome:0.3.154.3:::::::*
cpe:2.3:a:google:chrome:0.4.154.18:::::::*
cpe:2.3:a:google:chrome:0.4.154.22:::::::*
cpe:2.3:a:google:chrome:0.4.154.31:::::::*
cpe:2.3:a:google:chrome:0.4.154.33:::::::*
cpe:2.3:a:google:chrome:1.0.154.36:::::::*
cpe:2.3:a:google:chrome:1.0.154.39:::::::*
cpe:2.3:a:google:chrome:1.0.154.42:::::::*
cpe:2.3:a:google:chrome:1.0.154.43:::::::*
cpe:2.3:a:google:chrome:1.0.154.46:::::::*
cpe:2.3:a:google:chrome:1.0.154.48:::::::*
cpe:2.3:a:google:chrome:1.0.154.52:::::::*
cpe:2.3:a:google:chrome:1.0.154.53:::::::*
cpe:2.3:a:google:chrome:1.0.154.59:::::::*
cpe:2.3:a:google:chrome:1.0.154.65:::::::*
cpe:2.3:a:google:chrome:2.0.156.1:::::::*
cpe:2.3:a:google:chrome:2.0.157.0:::::::*
cpe:2.3:a:google:chrome:2.0.157.2:::::::*
cpe:2.3:a:google:chrome:2.0.158.0:::::::*
cpe:2.3:a:google:chrome:2.0.159.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.1:::::::*
cpe:2.3:a:google:chrome:2.0.170.0:::::::*
cpe:2.3:a:google:chrome:2.0.172:::::::*
cpe:2.3:a:google:chrome:2.0.172.2:::::::*
cpe:2.3:a:google:chrome:2.0.172.8:::::::*
cpe:2.3:a:google:chrome:2.0.172.27:::::::*
cpe:2.3:a:google:chrome:2.0.172.28:::::::*
cpe:2.3:a:google:chrome:2.0.172.30:::::::*
cpe:2.3:a:google:chrome:2.0.172.31:::::::*
cpe:2.3:a:google:chrome:2.0.172.33:::::::*
cpe:2.3:a:google:chrome:2.0.172.37:::::::*
cpe:2.3:a:google:chrome:2.0.172.38:::::::*
cpe:2.3:a:google:chrome:3.0.182.2:::::::*
cpe:2.3:a:google:chrome:3.0.190.2:::::::*
cpe:2.3:a:google:chrome::beta::::::*		3.0.193.2

No	URL	refsource	タグ
1	http://code.google.com/p/chromium/issues/detail?id=21338	CONFIRM	Vendor Advisory
2	http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html	CONFIRM
3	http://osvdb.org/58193	OSVDB
4	http://secunia.com/advisories/36770	SECUNIA	Vendor Advisory
5	http://www.securityfocus.com/bid/36416	BID