PT-2007-2513 · Google · Google Desktop

Published 2007-02-23 · Updated 2018-10-16 · CVE-2007-1085

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Desktop (affected versions not specified)

Description A cross-site scripting (XSS) issue allows remote attackers to bypass protection schemes and inject arbitrary web script or HTML, potentially gaining full access to the system. This is achieved by exploiting an XSS vulnerability in google.com to extract the signature for the internal web server, and then calling the under parameter in Advanced Search with the proper signature.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-1085

Affected Products

Google Desktop

References · 10

• 🔥 https://exploit-db.com/exploits/29623 · Exploit
• 🔥 http://securityfocus.com/bid/22650 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1085 · Security Note
• http://watchfire.com/resources/Overtaking-Google-Desktop.pdf · Note
• http://kb.cert.org/vuls/id/615857 · Note
• http://osvdb.org/33483 · Note
• http://securityfocus.com/archive/1/460735/100/0/threaded · Note
• http://securityfocus.com/archive/1/460928/100/0/threaded · Note
• http://securityreason.com/securityalert/2301 · Note
• http://securitytracker.com/id?1017686 · Note