PT-2007-7368 · Google · Google Toolbar

Published 2007-12-27 · Updated 2018-10-15 · CVE-2007-6536

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Toolbar versions 4 and 5 beta

Description The issue allows remote attackers to spoof domain names, making it easier to trick users into installing malicious button XML files. This is because the Custom Button Installer dialog presents certain domain names without verifying them, as seen in the "Downloaded from" and "Privacy considerations" sections. This can be exploited by presenting a trusted domain name, such as www.google.com, when the button was actually downloaded from an arbitrary site through an open redirector on the trusted domain.

Recommendations For Google Toolbar versions 4 and 5 beta, consider disabling the Custom Button Installer dialog until a patch is available to prevent the installation of malicious button XML files. Restrict access to the button installation feature to minimize the risk of exploitation. Avoid installing buttons from untrusted sources to reduce the risk of installing malicious files.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-6536

Affected Products

Google Toolbar

References · 8

• 🔥 http://aviv.raffon.net/2007/12/18/GoogleToolbarDialogSpoofingVulnerability.aspx · Exploit
• http://secunia.com/advisories/28166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6536 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39164 · Note
• http://securityfocus.com/bid/26923 · Note
• http://securityreason.com/securityalert/3491 · Note
• http://securityfocus.com/archive/1/485288/100/0/threaded · Note
• http://osvdb.org/39499 · Note