Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-3640

Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."

Published

2011-10-28T02:49:53.130

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.1 (HIGH)

CVSSv2 Vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: HIGH
Authentication: SINGLE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Primary
CWE-426

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	google	chrome	< 17.0	Yes
Operating System	apple	macos	-	No
Operating System	microsoft	windows	-	No

References

http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.html Exploit, Third Party Advisory ([email protected])
http://code.google.com/p/chromium/issues/detail?id=97426 Exploit, Issue Tracking, Patch, Vendor Advisory ([email protected])
http://securityreason.com/securityalert/8483 Third Party Advisory ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=641052 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://hermes.opensuse.org/messages/13154861 Broken Link ([email protected])
https://hermes.opensuse.org/messages/13155432 Broken Link ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414 Third Party Advisory ([email protected])
http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.html Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://code.google.com/p/chromium/issues/detail?id=97426 Exploit, Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://securityreason.com/securityalert/8483 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=641052 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://hermes.opensuse.org/messages/13154861 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://hermes.opensuse.org/messages/13155432 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)