Brand ClaimErleben, was verbindet

Information on the use of cookies

This website uses only the technically necessary cookies to provide you with the best possible service.
Your session is identified by a so-called session cookie in order to maintain your language choice and to allow a comfortable form use. Furthermore, a login is only possible by using a cookie.
Further information can be found in the data protection information.

Accept

Advisory 2024-1653 - All Major Browsers: Vulnerability allows bypassing security measures

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2024-1653
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
4
Attack probability
medium-high
3
Potential damage
medium
remote anonymous attackerUser interaction requiredExploit available
Date
2024-08-08
Release
2024-08-08

Operating System

  • Linux
  • MacOS X
  • Sonstiges

Software

  • Apple Safari
  • Google Chrome
  • Mozilla Firefox

Attack

A remote anonymous attacker can exploit a vulnerability in all major browsers in order to bypass security measures.

Description

Chrome is an Internet browser from Google. Firefox is an open source web browser. Safari is a Web Browser used on Apple devices.

There is a vulnerability in all major browsers. This flaw exists due to an inconsistent implementation of security mechanisms, allowing malicious websites to interact with local network services using the IP address 0.0.0.0. A remote anonymous attacker can exploit this vulnerability to bypass browser protection potentially leading to unauthorized access and remote code execution on local services by external attackers. Successful exploitation requires a user interaction.

CVSSv2 Base Score: 6.8 / Temporal Score: 6.5
AV:N/AC:M/AU:N/C:P/I:P/A:P/E:F/RL:U/RC:ND
CVSSv3.1 Base Score: 6.3 / Temporal Score: 6.2
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:F/RL:U/RC:X

Exploit code taking advantage of the vulnerability is available on the Internet.

Recommendation

There is currently no update or patch available to fix this vulnerability.
https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser

Information

Oligo Security Blog dated 2024-08-07
https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser

Forbes Artikel dated 2024-08-07
https://www.forbes.com/sites/thomasbrewster/2024/08/07/hackers-exploit-18-year-old-vulnerability-in-apple-google-and-mozilla-browsers/

References

VULNAME:0.0.0.0 DAY

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.