Google Toolbar Dialog Spoofing Vulnerability
BID:26923
Info
Google Toolbar Dialog Spoofing Vulnerability
| Bugtraq ID: | 26923 |
| Class: | Design Error |
| CVE: |
CVE-2007-6536 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 18 2007 12:00AM |
| Updated: | May 07 2015 05:34PM |
| Credit: | Aviv Raff is credited with the discovery of this issue. |
| Vulnerable: |
Google Toolbar 5 beta Google Toolbar 4 |
| Not Vulnerable: | |
Discussion
Google Toolbar Dialog Spoofing Vulnerability
Google Toolbar is prone to a dialog-spoofing vulnerability.
An attacker can exploit this issue by crafting a URI that contains a open redirector.
Successfully exploiting this issue may allow the attacker to convince an unsuspecting victim to install malicious custom buttons onto the victim's toolbar. This may lead to a false sense of trust and may also aid in phishing attacks. Other attacks are also possible.
This issue affects these versions:
Google Toolbar 5 beta for Internet Explorer
Google Toolbar 4 for Internet Explorer
Google Toolbar 4 for Firefox
Other versions running on different browsers may also be affected.
Google Toolbar is prone to a dialog-spoofing vulnerability.
An attacker can exploit this issue by crafting a URI that contains a open redirector.
Successfully exploiting this issue may allow the attacker to convince an unsuspecting victim to install malicious custom buttons onto the victim's toolbar. This may lead to a false sense of trust and may also aid in phishing attacks. Other attacks are also possible.
This issue affects these versions:
Google Toolbar 5 beta for Internet Explorer
Google Toolbar 4 for Internet Explorer
Google Toolbar 4 for Firefox
Other versions running on different browsers may also be affected.
Exploit / POC
Google Toolbar Dialog Spoofing Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Google Toolbar Dialog Spoofing Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Google Toolbar Dialog Spoofing Vulnerability
References:
References:
- Google Toolbar Dialog Spoofing Vulnerability (Aviv RaffOn.Net)
- Google Toolbar Homepage (Google)
- Google Toolbar Dialog Spoofing Vulnerability ("avivra"