Google Toolbar Dialog Spoofing Vulnerability

2007.12.28

Credit: avivra

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2007-6536

CWE: CWE-200

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Google Toolbar allows spoofing the information presented in the dialog which
is being displayed when adding a new Google Toolbar button. This can allow
an attacker to convince the users that his button comes from a trusted
domain. This button can then be used to download malicious files or conduct
phishing attacks (e.g. show a login form of a bank).

Affected versions
* Google Toolbar 5 beta for Internet Explorer 
* Google Toolbar 4 for Internet Explorer 
* Google Toolbar 4 for Firefox (partially)

Technical details:
http://aviv.raffon.net/2007/12/18/GoogleToolbarDialogSpoofingVulnerabili
ty.a
spx

--Aviv.

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Google Toolbar Dialog Spoofing Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.