CVE-2002-1442 The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a w...
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a window to tools.google.com or the res: protocol, then using script to modify the window's location to the toolbar's configuration URL, which bypasses the origin verification check.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google toolbar | = 1.1.41 | No fix listed |
| Google toolbar | = 1.1.42 | No fix listed |
| Google toolbar | = 1.1.43 | No fix listed |
| Google toolbar | = 1.1.44 | No fix listed |
| Google toolbar | = 1.1.45 | No fix listed |
| Google toolbar | = 1.1.47 | No fix listed |
| Google toolbar | = 1.1.48 | No fix listed |
| Google toolbar | = 1.1.49 | No fix listed |
| Google toolbar | = 1.1.53 | No fix listed |
| Google toolbar | = 1.1.54 | No fix listed |
| Google toolbar | = 1.1.55 | No fix listed |
| Google toolbar | = 1.1.56 | No fix listed |
| Google toolbar | = 1.1.57 | No fix listed |
| Google toolbar | = 1.1.58 | No fix listed |
References
- 20020808 Exploiting the Google toolbar (GM#001-MC) mailing-list
- 20020808 Exploiting the Google toolbar (GM#001-MC) exploit mailing-list patch vendor-advisory
- sec.greymagic.com
- 5424 exploit patch vdb-entry vendor-advisory