Detections
Analytics
Google Chrome < 1.0.154.53 Multiple Vulnerabilities
high Nessus Plugin ID 39449
Synopsis
The remote host contains a web browser that is affected by multiple vulnerabilities.Description
The version of Google Chrome installed on the remote host is earlier than 1.0.154.53. Such versions are reportedly affected by multiple vulnerabilities :- The browser uses the HTTP Host header to determine the context of a 4xx/5xx CONNECT response from a proxy server. This could allow a man-in-the-middle attacker to execute arbitrary script code in the context of a legitimate server, circumventing the browser's same- origin policy.
- The browser displays a cached certificate for 4xx/5xx CONNECT response pages from a proxy server. A man-in- the-middle attacker could exploit this by displaying a spoofed web page with the valid certificate of a legitimate website.
Solution
Upgrade to Google Chrome 1.0.154.53 or later.See Also
Plugin Details
Severity: High
ID: 39449
File Name: google_chrome_1_0_154_53.nasl
Version: 1.16
Type: Local
Agent: windows
Family: Windows
Published: 6/19/2009
Updated: 5/19/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2009-2071
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
CVSS Score Source: CVE-2009-2071
Vulnerability Information
CPE: cpe:/a:google:chrome
Required KB Items: SMB/Google_Chrome/Installed
Exploit Ease: No known exploits are available
Reference Information
CVE: CVE-2009-2060, CVE-2009-2071
CWE: 287