Google Toolbar About.HTML HTML Injection Vulnerability

Bugtraq ID:	11210
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 17 2004 12:00AM
Updated:	Sep 17 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to ViPeR <[email protected]>.
Vulnerable:	Google Toolbar 2.0.114 .1 Google Toolbar 1.1.60 Google Toolbar 1.1.59 Google Toolbar 1.1.58 Google Toolbar 1.1.57 Google Toolbar 1.1.56 Google Toolbar 1.1.55 Google Toolbar 1.1.54 Google Toolbar 1.1.53 Google Toolbar 1.1.49 Google Toolbar 1.1.48 Google Toolbar 1.1.47 Google Toolbar 1.1.45 Google Toolbar 1.1.44 Google Toolbar 1.1.43 Google Toolbar 1.1.42 Google Toolbar 1.1.41
Not Vulnerable:

Google Toolbar About.HTML HTML Injection Vulnerability

Google Toolbar is reported prone to a HTML injection vulnerability. It is reported that the Google Toolbar 'ABOUT.HTML' page allows the injection of HTML and JavaScript code.

This vulnerability may allow an attacker to inject malicious HTML and script code into the about page of the vulnerable application.

Google Toolbar About.HTML HTML Injection Vulnerability

The following proof of concept is available:

<s c r i p t>
window.showModalDialog("res://C:\\Program%20Files\\Google\\GoogleToolbar1.dll/ABOUT.HTML",
"<div style=\"background-image:
url(javascript:alert(location.href));\">");
</s c r i p t>

Google Toolbar About.HTML HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Google Toolbar About.HTML HTML Injection Vulnerability

References:

• Google Toolbar Homepage (Google)
  
• GoogleToolbar:About -- Allows Script Injection (ViPeR )