Google patches nine bugs in Chrome 17

Google has patched nine vulnerabilities in Chrome in the sixth security update to Chrome 17, the edition that launched on February 8.

The update was the first since the Chrome security team issued a pair of quick fixes during the “Pwnium” hacking event held earlier this month at the CanSecWest security conference.

Six of the nine bugs patched were rated “high,” the second-most dire ranking in Google’s threat system. One was marked “medium,” and the remaining two were labeled “low.”

Google paid $5,500 in bounties to four researchers for reporting five bugs. The four other vulnerabilities were uncovered by members of Google’s own security team or were too minor to be eligible for a bonus.

Cross-origin violation

Three of the four researchers who reported flaws fixed in Chrome 17 have been recently recognised by Google.

Sergey Glazunov, who received a $2,000 bounty for submitting a bug described by Google as “cross-origin violation with ‘magic iframe’,” was one of two $60,000 prize winners at Pwnium earlier this month.

Glazunov was the first to claim cash at Pwnium, the Chrome-only hacking challenge that Google created after it withdrew from the long-running Pwn2Own contest over objections about the latter’s exploit reporting practices.

Two others, Arthur Gerkis and a researcher known as “miaubiz”, received $1,000 and $2,000, respectively, for bugs that Google patched.

Gerkis and miaubiz were two of the three outside bug hunters who were given special $10,000 bonuses three weeks ago for what Google called “sustained, extraordinary” contributions to its vulnerability reporting programme.

Sandbox escape

So far this year, Google has paid nearly $200,000 to outside researchers through its bug bounty and Pwnium programs.

Google will not be patching a Chrome bug revealed in “Pwn2Own,” the other hacking contest that ran at CanSecWest.

At Pwn2Own, a team from the French security firm Vupen exploited Chrome by using a one-two punch of a bug in Flash Player – which Google bundles with its browser – and a Chrome “sandbox escape” vulnerability.

Because Pwn2Own sponsor HP TippingPoint’s Zero Day Initiative (ZDI) bug bounty programme does not require researchers to disclose sandbox escape vulnerabilities, Google was not told how the Vupen team hacked Chrome.

The update to Chrome 17 can be downloaded for Windows, Mac OS X and Linux from Google’s website. Users running the browser will receive the new version automatically through its silent, in-the-background update service.

Article source: http://rss.feedsportal.com/c/270/f/3551/s/1db69ad9/l/0Lnews0Btechworld0N0Csecurity0C33465730Cgoogle0Epatches0Enine0Ebugs0Ein0Echrome0E170C0Dolo0Frss/story01.htm

View full post on National Cyber Security » Computer Hacking