Security firm discovers Chrome 'SaveAs' flaw

08 Sep 2008 09:11

Bach Khoa Internet Security of Vietnam has reported that the Google browser is susceptible to a critical buffer-overflow flaw

A company in Vietnam has turned up the latest vulnerability in Chrome, according to a story posted to Information Week's website.

Bach Khoa Internet Security says the Chrome 0.2.149.27 release is susceptible to a critical buffer-overflow flaw, which could allow a remote attacker to take control of a PC. BKIS says it has reported the vulnerability to Google.

BKIS explained the security flaw: "The vulnerability is caused due to a boundary error when handling the 'SaveAs[ function. On saving a malicious page with an overly long title (title tag in HTML), the program causes a stack-based overflow and makes it possible for attackers to execute arbitrary code on users' systems.

The security company described how the flaw could be exploited: "A hacker might construct a specially crafted web page, which contains malicious code. He then tricks users into visiting his website and convinces them to save this page. Right after that, the code would be executed, giving him the privilege to make use of the affected system. "

Earlier this week, security researcher Rishi Narang reported a flaw related to how Chrome, still in beta, behaves with undefined handlers, while another researcher, Aviv Raff, developed a proof-of-concept demo that showed Chrome could be hit with a carpet-bombing flaw.

For full coverage of the Google Chrome launch, see ZDNet.co.uk's roundup.

Story URL: http://news.zdnet.co.uk/internet/0,1000000097,39485521,00.htm