09 February 2007 | 5,701 views

Google Fixes Serious Vulnerability in Gmail

Check Your Web Security with Acunetix

Google started the new year by fixing a serious vulnerability in Gmail.

This was quite an interesting case and once again (as everything relating to web apps seems to be nowdays) it was an XSS flaw that allowed malicious attackers to steal your contact list, leading to some pretty bad information leakage.

Google has fixed a vulnerability in its popular GMail web mail service that creates a means for hackers to steal users’ contact lists.

The cross-site scripting flaw stemmed from the decision by GMail to store contact lists in a JavaScript file. GMail always saves contact lists as JavaScript code using the same URL, so a script featuring this URL can read out the fields of a users’ contact list. GMail failed to check what sites were attempting to run this “callback” function.

There was a previous very similar flaw on Google which effected computers with multiple Gmail users.

As a result users logged into GMail, or other Google services sharing the same login, are liable to hand over their contact list to spammers or other miscreants providing they are tricked into visiting a maliciously constructed website. Exploitation would have been as simple as fooling users into visiting a hostile website through spam messages sent to users’ email accounts.

Coders failed to take into account that it was a bad idea to save sensitive data as JavaScript, under predictable URLs, a problem Google watchers spotted shortly after Google made the coding changes last week

I do like Google though, they tend to fix things pretty fast!

Source: The Register



Recent in Exploits/Vulnerabilities:
- OpenVPN Vulnerable To Shellshock Exploit
- Everything You NEED To Know About Shellshock Bug In BASH
- drozer – The Leading Security Testing Framework For Android

Related Posts:
- Google Agrees To Pay $ 8.5 Million To Settle Buzz Class Action Lawsuit
- Major Web Vulnerability Effects Yahoo, MSN, Google and More
- Spammers Harnessing Web Mail Servers – Gmail & Yahoo! Throttled

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 227,797 views
- AJAX: Is your application secure enough? - 119,146 views
- eEye Launches 0-Day Exploit Tracker - 85,070 views

Low-cost VPS Hosting

Comments are closed.