NVD

Id
20505  
Name
CVE-2016-5166  
Description
The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-09-11  
Modified Date
2016-11-28  
Seq
2016-5166  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
112329 20505 CVE-2016-5166 openSUSE-SU-2016:2250  View
112330 20505 CVE-2016-5166 SUSE-SU-2016:2251  View
112331 20505 CVE-2016-5166 openSUSE-SU-2016:2296  View
112332 20505 CVE-2016-5166 openSUSE-SU-2016:2349  View
112333 20505 CVE-2016-5166 RHSA-2016:1854  View
112334 20505 CVE-2016-5166 DSA-3660  View
112335 20505 CVE-2016-5166 92717  View
112336 20505 CVE-2016-5166 https://codereview.chromium.org/2075273002  View
112337 20505 CVE-2016-5166 https://crbug.com/616429  View
112338 20505 CVE-2016-5166 https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3843 JVNDB-2016-004616 Google Chrome のダウンロードの実装における NetNTLM ハッシュを取得される脆弱性 Google Chrome のダウンロードの実装は、http:// URL により参照される file:// URL の保存を適切に制限しないため、NetNTLM ハッシュを取得され、SMB Relay 攻撃を実行される脆弱性が存在します。 CVE-2016-5166 91672 CVE-2016-5166 20505 2.6 3.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004616.html 2016-08-31 2016-11-18 View