CVE-2007-6536: Infoleak
First published: Thu Dec 27 2007(Updated: )
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing malicious button XML files, as demonstrated by presenting www.google.com when the button was downloaded from an arbitrary site through an open redirector on www.google.com.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Toolbar | =5-beta | |
| Google Toolbar | =4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://aviv.raffon.net/2007/12/18/GoogleToolbarDialogSpoofingVulnerability.aspx
- http://secunia.com/advisories/28166
- http://securityreason.com/securityalert/3491
- http://www.securityfocus.com/bid/26923
- http://www.osvdb.org/39499
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39164
- http://www.securityfocus.com/archive/1/485288/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-6536?
CVE-2007-6536 has a severity rating that indicates it can potentially allow remote attackers to spoof domain names.
How do I fix CVE-2007-6536?
To fix CVE-2007-6536, you should upgrade to a newer version of Google Toolbar where this vulnerability is resolved.
What software is affected by CVE-2007-6536?
CVE-2007-6536 affects Google Toolbar versions 4 and 5 beta.
What are the implications of CVE-2007-6536?
The implications of CVE-2007-6536 include the possibility of users being tricked into installing malicious software due to spoofed domain names.
When was CVE-2007-6536 discovered?
CVE-2007-6536 was discovered in 2007.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/google
- canonical/google toolbar
- version/google toolbar/5-beta
- version/google toolbar/4