Is CVE-2016-5214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-5214 being exploited in the wild.

How severe is CVE-2016-5214?

Medium severity, with a CVSS score of 4.3, published 19 January 2017.

Which products and versions are affected?

Google Chromium < 55.0.2883.75.

Is there a fix for CVE-2016-5214?

A patch was published on 2016-12-01: Chrome 55.0.2883.75 released to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-5214 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-5214?

Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5214: Google Chrome Mark of the Web bypass in file downloads

Q: Which products and versions are affected?

Google Chromium < 55.0.2883.75.

Q: Is there a fix for CVE-2016-5214?

A patch was published on 2016-12-01: Chrome 55.0.2883.75 released to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2016-5214 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2016-5214?

Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5214 · Severity: medium · CVSS 4.3 · Published 2017-01-19

Google Chrome for Windows contained a flaw that allowed downloaded files to bypass a security feature known as 'Mark of the Web.' This feature is used by the operating system to identify files from the internet and trigger security warnings before they are opened. An attacker could use a malicious website to trick a user into downloading a file that would then appear to be from a trusted local source, potentially leading to the execution of harmful software without the usual security prompts.

Technologies: Google Chrome, Google Chromium. Vendors: Google.

Quick answers

Is CVE-2016-5214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-5214 being exploited in the wild.
How severe is CVE-2016-5214?: Medium severity, with a CVSS score of 4.3, published 19 January 2017.
Which products and versions are affected?: Google Chromium < 55.0.2883.75.
Is there a fix for CVE-2016-5214?: A patch was published on 2016-12-01: Chrome 55.0.2883.75 released to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-5214 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-5214?: Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Google Chrome prior to 55.0.2883.75 for Windows allowed a remote attacker to prevent downloaded files from receiving the 'Mark of the Web' (MotW) NTFS alternate data stream. By using a crafted HTML page, an attacker could trigger a download that bypasses this security zone identifier. This bypass is significant because Windows and other applications use the MotW to apply restrictive security policies, such as Protected View in Office or 'Open File - Security Warning' prompts. The vulnerability is categorized under CWE-19 (Data Processing Errors) and requires user interaction to visit a malicious site and initiate a download. The issue was resolved in version 55.0.2883.75.

Affected products

Google Chrome < 55.0.2883.75
Google Chromium < 55.0.2883.75

Timeline

2016-12-01: patched: Chrome 55.0.2883.75 released to stable channel
2017-01-19: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.