PT-2007-7368 · Google · Google Toolbar

Publicado 2007-12-27 · Atualizado 2018-10-15 · CVE-2007-6536

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Toolbar versions 4 and 5 beta

Description The issue allows remote attackers to spoof domain names, making it easier to trick users into installing malicious button XML files. This is because the Custom Button Installer dialog presents certain domain names without verifying them, as seen in the "Downloaded from" and "Privacy considerations" sections. This can be exploited by presenting a trusted domain name, such as www.google.com, when the button was actually downloaded from an arbitrary site through an open redirector on the trusted domain.

Recommendations For Google Toolbar versions 4 and 5 beta, consider disabling the Custom Button Installer dialog until a patch is available to prevent the installation of malicious button XML files. Restrict access to the button installation feature to minimize the risk of exploitation. Avoid installing buttons from untrusted sources to reduce the risk of installing malicious files.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-6536

Produtos afetados

Google Toolbar

Referências · 8

• 🔥 http://aviv.raffon.net/2007/12/18/GoogleToolbarDialogSpoofingVulnerability.aspx · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39164 · Nota
• http://securityfocus.com/bid/26923 · Nota
• http://secunia.com/advisories/28166 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-6536 · Nota de Segurança
• http://securityreason.com/securityalert/3491 · Nota
• http://securityfocus.com/archive/1/485288/100/0/threaded · Nota
• http://osvdb.org/39499 · Nota