Google Chrome DNS Pre-Fetching Proxy Cache Information Disclosure Vulnerability

Bugtraq ID:	37326
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 14 2009 12:00AM
Updated:	Dec 14 2009 10:53PM
Credit:	Christopher Eatinger
Vulnerable:	Google Chrome 3.0.195 .33 Google Chrome 3.0.195 .32 Google Chrome 3.0.195 .24 Google Chrome 3.0.195 .21 Google Chrome 3.0 Beta
Not Vulnerable:

Google Chrome DNS Pre-Fetching Proxy Cache Information Disclosure Vulnerability

Google Chrome is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Chrome 3.0.195.33 is vulnerable; other versions may also be affected.

Google Chrome DNS Pre-Fetching Proxy Cache Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google Chrome DNS Pre-Fetching Proxy Cache Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google Chrome DNS Pre-Fetching Proxy Cache Information Disclosure Vulnerability

References:

• DNS queries not forwarded through SOCKS proxies (Christopher Eatinger)
  
• Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fet (nixlists (nixmlistsgmail.com))
  
• Google Chrome Homepage (Google)