CVE-2017-15424: Input Validation
An url spoof flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=756226
External References:
https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
Other sources
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 63.0.3239.84 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 63.0.3239.84
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to interact with a crafted domain name using IDN homographs. The CVSS vector indicates the attack can be delivered remotely, requires no privileges, and requires user interaction.
Which browser versions are affected?
Google Chrome versions prior to 63.0.3239.84 are affected. The listed affected software also includes Chromium Browser packages for Debian and Red Hat environments.
What is the practical impact of successful exploitation?
Successful exploitation allows domain spoofing in the browser address bar, which can make a crafted internationalized domain appear to represent another domain. This can support phishing or redirection to an attacker-controlled site; the supplied CVSS assessment rates integrity impact as high and confidentiality and availability impact as none.