Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome before 33.0.1750.117 on Windows allows attackers to bypass intended named-pipe policy restrictions in the sandbox via vectors related to (1) lack of checks for .. (dot dot) sequences or (2) lack of use of the \\?\ protection mechanism.

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

28 security fixes in this release, including :

- [334897] High CVE-2013-6652: Issue with relative paths in Windows sandbox named pipe policy. Credit to tyranid.

- [331790] High CVE-2013-6653: Use-after-free related to web contents.
Credit to Khalil Zhani.

- [333176] High CVE-2013-6654: Bad cast in SVG. Credit to TheShow3511.

- [293534] High CVE-2013-6655: Use-after-free in layout. Credit to cloudfuzzer.

- [331725] High CVE-2013-6656: Information leak in XSS auditor. Credit to NeexEmil.

- [331060] Medium CVE-2013-6657: Information leak in XSS auditor.
Credit to NeexEmil.

- [322891] Medium CVE-2013-6658: Use-after-free in layout. Credit to cloudfuzzer.

- [306959] Medium CVE-2013-6659: Issue with certificates validation in TLS handshake. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco, Inria Paris.

- [332579] Low CVE-2013-6660: Information leak in drag and drop.
Credit to bishopjeffreys.

- [344876] Low-High CVE-2013-6661: Various fixes from internal audits, fuzzing and other initiatives. Of these, seven are fixes for issues that could have allowed for sandbox escapes from compromised renderers.

The Google Chrome browser detected on the remote system is older than version 33.0.1750.117, and is therefore vulnerable to the following issues:

  - Undisclosed vulnerability exists with relative paths in Windows sandbox named pipe policy (CVE-2013-6652)

  - Use-after free issues related to web contents (CVE-2013-6653) and layout (CVE-2013-6655, CVE-2013-6658)

  - Undisclosed vulnerability in Bad cast in SVG (CVE-2013-6654)

  - Information-disclosure vulnerabilities with XSS auditor (CVE-2013-6656, CVE-2013-6657) and drag-and-drop (CVE-2013-6660)

  - Security-bypass vulnerability during certificates validation in a TLS handshake (CVE-2013-6659)

  - Other additional issues undisclosed by the vendor (CVE-2013-6661)

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.117.  It is, therefore, affected by the following vulnerabilities :

  - An error exists related to relative path in Windows     sandbox named pipe policy. (CVE-2013-6652)

  - Use-after-free errors exist related to handling     web components and layout. (CVE-2013-6653,     CVE-2013-6655, CVE-2013-6658)

  - A casting error exists related to SVG processing.
    (CVE-2013-6654)

  - Errors exist related to the XSS auditor that could lead     to disclosure of information. (CVE-2013-6656,     CVE-2013-6657)

  - An error exists related to certificate validation and     TLS handshake processing. (CVE-2013-6659)

  - An error exists related to drag and drop handling that     could lead to disclosure of information. (CVE-2013-6660)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6661)

ID	Name	Product	Family	Severity
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72676	FreeBSD : chromium -- multiple vulnerabilities (9dd47fa3-9d53-11e3-b20f-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
8130	Google Chrome < 33.0.1750.117 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
72616	Google Chrome < 33.0.1750.117 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-6652

critical

Tenable Plugins

critical

high

medium

high