Google Desktop vulnerable to cross-site scripting

Overview

A cross-site scripting vulnerability exists in the Google Desktop Search application. This vulnerability may allow an attacker to take any action on a vulnerable system that the Google Desktop Search can.

Description

Google Desktop Search is a desktop search program that is integrated into the Google search engine. Google Desktop Search indexes the user’s local hard drive, and allows the results to be searched from a browser.

The Google Desktop Search program contains a cross-site scripting vulnerability in the under parameter. This vulnerability occurs because the Google Desktop Search engine fails to properly sanitize user input.

Note that this vulnerability may not be exploited remotely without the presence of another vulnerability.

---

Impact

A remote unauthenticated attacker may be able to perform any action that the Google Desktop Search engine is capable of performing. This includes executing programs that are already on a vulnerable system, searching and viewing files and exfiltrating sensitive data.

---

Solution

Upgrade
Google has addressed this issue in the most recent version of the Google Desktop Search. Note that Google updates the Google Desktop Search automatically.

---

Disable JavaScript

Disable JavaScript in your browser’s preferences. Instructions for disabling JavaScript can be found in the Securing Your Web Browser document and the Malicious Web Scripts FAQ. Some Mozilla add-ons can simplify the ability to enable or disable JavaScript, or set up site-specific rules for doing so.

---

Vendor Information

615857

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Google Affected

Updated: February 22, 2007

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://desktop.google.com/&gt;
• http://desktop.google.com/support/bin/answer.py?answer=15935&topic=95
• <http://www.watchfire.com/resources/Overtaking-Google-Desktop.pdf&gt;
• <http://www.cert.org/tech_tips/securing_browser/#how_to_secure&gt;
• <http://www.cert.org/tech_tips/malicious_code_FAQ.html&gt;
• <http://www.cert.org/tech_tips/securing_browser/&gt;
• <https://addons.mozilla.org/&gt;
• http://news.com.com/IE+flaw+lets+intruders+into+Google+Desktop/2100-7349_3-5980623.html?part=rss&tag=5980623&subj=news

Acknowledgements

Thanks to Yair Amit, Danny Allan, and Adi Sharabani for providing information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

CVE IDs:	None
Severity Metric:	0.52 Date Public: