Security threats Toolkit

Google patches XSS security flaw

Tags:
XSS

Tom Espiner ZDNet.co.uk

Published: 16 Jan 2007 15:32 GMT

Google has patched a cross-site scripting (XSS) vulnerability in one of its web-hosting services.

If left unpatched, the vulnerability could have allowed hackers to modify third-party Google documents and spreadsheets, and view mail subjects and search history, according to the Google Blogoscoped blog.

Philipp Lenssen, the author of Google Blogoscoped, a third-party site that comments on Google developments, said the vulnerability was similar to another vulnerability in Blogger Custom Domains reported on Sunday night.

"The security hole is connected to an update to a specific Google service which doesn't correctly defend against HTML injections," he said.

According to Lenssen, the earlier Custom Domains vulnerability allowed another Google expert, Tony Ruscoe, to create a page that was hosted on a google.com domain. Ruscoe was able to prove that he could have used code to steal a user's Google cookie and access their Google services.

The second vulnerability, reported by Lensson, would also have enabled a hacker to use JavaScript code to pass cookie data to an external source.

Google UK had not responded to a request for comment at the time of writing.

Did you find this article useful?
5 out of 5 people found this useful

Post a comment

Full Talkback thread

0 comments

More In Security threats

Company/Topic Alerts

Create a new alert from the list below:

Related Jobs

FICO Consultant/Analyst, Cambridge 50,000+

Based on the customers requirements you will provide functional SAP expertise to discuss and design potential solutions, and implement those ...

System Administrator - Oddschecker.com

Good working knowledge of setting up and hosting multiple domains. System Administrator - Oddschecker.com Advert REF CODE : 8398 Here at Sky, ...

SAP Technical CRM Consultant (remote)

The client needs some custom developments. SAP Technical CRM Consultant (remote) For a small project for a customer we are looking for a technical ...

Featured Talkback

On the contrary, if vendors were forced to stand behind their products it should increase innovation. It would force more, and better , testing before hitting the sales floor, resulting in fewer updates and less downtime for the consumer. At present the EULA removes responsibility from the vendor, and moves it to the user, which is a step backward. Make the vendor responsibility for their code.