Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves the page and a long filename is generated. NOTE: it might be possible to exploit this issue via an HTTP response that includes a long filename in a Content-Disposition header.

The version of Google Chrome installed on the remote host is earlier than 0.2.149.29.  Such versions are reportedly are affected by several issues : 

  - A buffer overflow involving long filenames that display in the 'Save As...' dialog could lead to arbitrary code execution (Issue number 1414).
  - A buffer overflow in handling of link targets displayed in the status area when a user hovers over a link could lead to arbitrary code execution (Fix number 1797).
  - An out-of-bounds memory read when parsing URLs ending in ': %' could cause the application itself to crash (Issue number 122).
  - The default Downloads directory is set to Desktop, which could lead to malicious cluttering of the desktop with unwanted downloads and even execution of arbitrary programs (Fix number 17933).

The version of Google Chrome installed on the remote host is earlier than 0.2.149.29.  Such versions are reportedly affected by several issues :

  - A buffer overflow involving long filenames that display     in the 'Save As...' dialog could lead to arbitrary code     execution (Issue #1414).

  - A buffer overflow in handling of link targets displayed     in the status area when a user hovers over a link could     lead to arbitrary code execution (Fix #1797).

  - An out-of-bounds memory read when parsing URLs ending in     ':%' could cause the application itself to crash (Issue     #122).

  - The default Downloads directory is set to Desktop, which     could lead to malicious cluttering of the desktop with     unwanted downloads and even execution of arbitrary     programs (Fix #17933).

ID	Name	Product	Family	Severity
4681	Google Chrome < 0.2.149.29 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
34197	Google Chrome < 0.2.149.29 Multiple Vulnerabilities	Nessus	Windows	high
800912	Google Chrome < 0.2.149.29 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-6994

high

Tenable Plugins

medium

high

high