PT-2004-3367 · Google · Google Toolbar

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2475

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Google Toolbar version 2.0.114.1

Description: A cross-site scripting (XSS) issue may exist, potentially allowing remote attackers to inject arbitrary web script via the about.html in the About section. However, it is noted that the demonstration code's use of the res:// protocol might not cross privilege boundaries since it is not allowed in the Internet Zone, which could mean this might not be a vulnerability.

Recommendations: For Google Toolbar version 2.0.114.1, consider avoiding the use of the About section until further clarification or a fix is provided. As a temporary workaround, restrict access to the about.html section to minimize potential risks. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2004-2475

Affected Products

Google Toolbar

References · 9

• 🔥 http://securitytracker.com/id?1011351 · Exploit
• 🔥 http://securityfocus.com/bid/11210 · Exploit
• 🔥 https://exploit-db.com/exploits/24607 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2004-09/0226.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2475 · Security Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0629.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17435 · Note
• http://osvdb.org/10037 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0639.html · Note