Vulnerability Details : CVE-2010-0643
Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
Vulnerability category: Information leak
Products affected by CVE-2010-0643
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.2.149.29:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.2.149.30:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.36:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.2.149.27:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:3.0.190.2:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.8:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.2:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.33:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.169.1:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.48:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.52:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.3.154.3:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.2.153.1:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.28:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.38:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.158.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.169.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.159.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.37:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.59:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:3.0.193.2:beta:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:3.0.195.33:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:3.0.195.32:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:3.0.195.21:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.27:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.156.1:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.31:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172.30:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.39:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.42:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.65:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.2.152.1:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.4.154.31:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.4.154.22:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.4.154.33:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:3.0.195.24:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:3.0.182.2:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.157.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.157.2:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.172:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:2.0.170.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.53:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.46:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:1.0.154.43:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.4.154.18:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:0.3.154.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2010-0643
0.44%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2010-0643
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2010-0643
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-0643
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14500
Repository / Oval Repository
-
http://code.google.com/p/chromium/issues/detail?id=12303
12303 - Chrome falls back to DIRECT connections once all proxies have failed. - chromium - Monorail
-
http://www.vupen.com/english/advisories/2010/0361
Webmail | OVH- OVHVendor Advisory
-
http://www.securityfocus.com/bid/38177
Google Chrome prior to 4.0.249.89 Multiple Security Vulnerabilities
-
http://securitytracker.com/id?1023583
Google Chrome Bugs Let Remote Users Execute Arbitrary Code and Obtain Information - SecurityTracker
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/56212
Google Chrome fall-back information disclosure CVE-2010-0644 Vulnerability Report
-
http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html
Chrome Releases: Stable Channel UpdatePatch
-
http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
Page not found - The Chromium ProjectsVendor Advisory
Jump to