You are here: silicon.com > Software > Security Strategy

Security Strategy

Google slams the door on XSS flaw

'Stop cookie thief!'

Tags: xss, flaw, google

By Tom Espiner

Published: 17 January 2007 09:15 GMT

Google has patched a cross-site scripting (XSS) vulnerability in one of its web-hosting services.

If left unpatched, the vulnerability could have allowed hackers to modify third-party Google documents and spreadsheets, and view mail subjects and search history, according to the Google Blogoscoped blog.

Philipp Lenssen, the author of Google Blogoscoped - a third-party site that comments on Google developments - said the vulnerability was similar to another vulnerability in Blogger Custom Domains, reported at the weekend.

He said: "The security hole is connected to an update to a specific Google service which doesn't correctly defend against HTML injections."

According to Lenssen, the earlier Custom Domains vulnerability allowed another Google expert, Tony Ruscoe, to create a page that was hosted on a Google.com domain. Ruscoe was able to prove he could have used code to steal a user's Google cookie and access their Google services.

The second vulnerability, reported by Lensson, would also have enabled a hacker to use JavaScript code to pass cookie data to an external source.

Google UK had not responded to a request for comment at the time of writing.

Tom Espiner writes for ZDNet UK

  1. Zones
  2. Management
  3. Networks
  4. Software
  5. IT Services
  6. Hardware
  1. Verticals
  2. Public Sector
  3. Financial Services
  4. Retail & Leisure

  • Jobs
Technical Data Analyst

These responsibilities will be as follows:- Data extraction- Data extraction from multiple database types using different extraction methodologies- ...

Head of Third Party Operations - Geneva

One of their key business units, contributing approximately $3.5 billion, has recently experienced major developments in supply chain and procurement ...

Senior Embedded Software Engineer (Multi Core/Parallel Processing)

UNIX or BSD operating system fundamentals Encryption algorithms Error correcting codes and cyclic redundancy checking Testing and verification of ...

Agenda Setters 2008
Welcome to the ninth annual Agenda Setters poll – silicon.com's list of the top 50 most influential individuals in the technology and IT industries, from techies and CIOs to entrepreneurs and business leaders. Find out more in our latest special report.





Quick Sitemap Links: