Google Desktop Search Remote Information Disclosure Vulnerability
BID:12052
Info
Google Desktop Search Remote Information Disclosure Vulnerability
| Bugtraq ID: | 12052 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 20 2004 12:00AM |
| Updated: | Dec 20 2004 12:00AM |
| Credit: | Discovery is credited to Seth Nielson, Seth J. Fogarty, and Dan S. Wallach. |
| Vulnerable: |
Google Desktop Search |
| Not Vulnerable: | |
Discussion
Google Desktop Search Remote Information Disclosure Vulnerability
Google Desktop Search is reported prone to a remote vulnerability that may allow an attacker to disclose a user's search results from the local computer.
The attacker entices a user to visit the site and creates a Java applet to leverage this vulnerability. When the Java applet is loaded by the user, it can send queries to the attacker's server that appear to be Google queries to the Desktop Search application.
The Desktop Search application integrates local search results with the queries and this information is sent to the remote server controlled by the attacker.
Google Desktop Search is reported prone to a remote vulnerability that may allow an attacker to disclose a user's search results from the local computer.
The attacker entices a user to visit the site and creates a Java applet to leverage this vulnerability. When the Java applet is loaded by the user, it can send queries to the attacker's server that appear to be Google queries to the Desktop Search application.
The Desktop Search application integrates local search results with the queries and this information is sent to the remote server controlled by the attacker.
Exploit / POC
Google Desktop Search Remote Information Disclosure Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Google Desktop Search Remote Information Disclosure Vulnerability
Solution:
Google has released an upgrade to address this issue. Please contact the vendor for more information.
Solution:
Google has released an upgrade to address this issue. Please contact the vendor for more information.
References
Google Desktop Search Remote Information Disclosure Vulnerability
References:
References:
- Attacks on Local Searching Tools (Department of Computer Science, Rice University)
- Google Desktop Search Home Page (Google)