CVE-2007-6536: Infoleak

Published Dec 27, 2007

Updated

The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing malicious button XML files, as demonstrated by presenting www.google.com when the button was downloaded from an arbitrary site through an open redirector on www.google.com.

Affected Software

2 affected components

Google toolbar=5-beta

Google toolbar=4

Event History

Dec 27, 2007

CVE Published

11:46 PM

Dec 28, 2007

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-6536?

CVE-2007-6536 has a severity rating that indicates it can potentially allow remote attackers to spoof domain names.

How do I fix CVE-2007-6536?

To fix CVE-2007-6536, you should upgrade to a newer version of Google Toolbar where this vulnerability is resolved.

What software is affected by CVE-2007-6536?

CVE-2007-6536 affects Google Toolbar versions 4 and 5 beta.

What are the implications of CVE-2007-6536?

The implications of CVE-2007-6536 include the possibility of users being tricked into installing malicious software due to spoofed domain names.

When was CVE-2007-6536 discovered?

CVE-2007-6536 was discovered in 2007.