FKIE_CVE-2008-6994

Vulnerability from fkie_nvd - Published: 2009-08-19 05:24 - Updated: 2026-04-23 00:35
Severity ?
Summary
Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves the page and a long filename is generated. NOTE: it might be possible to exploit this issue via an HTTP response that includes a long filename in a Content-Disposition header.
References
cve@mitre.orghttp://code.google.com/p/chromium/issues/detail?id=1414
cve@mitre.orghttp://osvdb.org/48259
cve@mitre.orghttp://security.bkis.vn/?p=119Exploit
cve@mitre.orghttp://securitytracker.com/id?1020823Exploit
cve@mitre.orghttp://src.chromium.org/viewvc/chrome/branches/chrome_official_branch/src/chrome/common/win_util.cc?r1=1757&r2=1766&pathrev=1766Exploit
cve@mitre.orghttp://www.infoworld.com/d/security-central/critical-vulnerability-patched-in-googles-chrome-599Exploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/496042/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/31029Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/31031Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/44935
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/44939
cve@mitre.orghttps://www.exploit-db.com/exploits/6365
cve@mitre.orghttps://www.exploit-db.com/exploits/6367
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/chromium/issues/detail?id=1414
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/48259
af854a3a-2127-422b-91ae-364da2661108http://security.bkis.vn/?p=119Exploit
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1020823Exploit
af854a3a-2127-422b-91ae-364da2661108http://src.chromium.org/viewvc/chrome/branches/chrome_official_branch/src/chrome/common/win_util.cc?r1=1757&r2=1766&pathrev=1766Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.infoworld.com/d/security-central/critical-vulnerability-patched-in-googles-chrome-599Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/496042/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/31029Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/31031Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/44935
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/44939
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/6365
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/6367
Impacted products
Vendor Product Version
google chrome 0.2.149.27
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:0.2.149.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "D55D5075-D233-42D6-B1D6-77B7599650EB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves the page and a long filename is generated.  NOTE: it might be possible to exploit this issue via an HTTP response that includes a long filename in a Content-Disposition header."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento del b\u00fafer en la regi\u00f3n stack de la memoria en la funci\u00f3n SaveAs (funci\u00f3n SaveFileAsWithFilter) en el archivo win_util.cc en Chrome de Google versi\u00f3n  0.2.149.27,  permite a los atacantes remotos asistidos por el usuario ejecutar c\u00f3digo arbitrario por medio de una p\u00e1gina web con un elemento TITLE largo, que desencadena el desbordamiento cuando el usuario guarda las p\u00e1ginas y es generado un nombre de archivo largo. NOTA: podr\u00eda ser posible explotar este problema por medio de una respuesta HTTP que incluye un nombre de archivo largo en un encabezado Content-Disposition."
    }
  ],
  "id": "CVE-2008-6994",
  "lastModified": "2026-04-23T00:35:47.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-08-19T05:24:52.687",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://code.google.com/p/chromium/issues/detail?id=1414"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/48259"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://security.bkis.vn/?p=119"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://securitytracker.com/id?1020823"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://src.chromium.org/viewvc/chrome/branches/chrome_official_branch/src/chrome/common/win_util.cc?r1=1757\u0026r2=1766\u0026pathrev=1766"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.infoworld.com/d/security-central/critical-vulnerability-patched-in-googles-chrome-599"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/496042/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/31029"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/31031"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44935"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44939"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/6365"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/6367"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://code.google.com/p/chromium/issues/detail?id=1414"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/48259"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://security.bkis.vn/?p=119"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://securitytracker.com/id?1020823"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://src.chromium.org/viewvc/chrome/branches/chrome_official_branch/src/chrome/common/win_util.cc?r1=1757\u0026r2=1766\u0026pathrev=1766"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.infoworld.com/d/security-central/critical-vulnerability-patched-in-googles-chrome-599"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/496042/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/31029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/31031"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44935"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44939"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/6365"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/6367"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.