CVE-2002-1443
CVSS5.0
发布时间 :2003-04-11 00:00:00
修订时间 :2008-09-05 16:30:36
NMCOS    

[原文]The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler.


[CNNVD]多个供应商工具栏按键监测信息泄露漏洞(CNNVD-200304-079)

        Google工具栏1.1.58及其早期版本存在漏洞。远程web网站借助"onkeydown"项目处理器监测用户对工具栏的输入。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:google:toolbar:1.1.58Google Google Toolbar 1.1.58
cpe:/a:google:toolbar:1.1.53Google Google Toolbar 1.1.53
cpe:/a:google:toolbar:1.1.57Google Google Toolbar 1.1.57
cpe:/a:google:toolbar:1.1.55Google Google Toolbar 1.1.55
cpe:/a:google:toolbar:1.1.54Google Google Toolbar 1.1.54
cpe:/a:google:toolbar:1.1.44Google Google Toolbar 1.1.44
cpe:/a:google:toolbar:1.1.41Google Google Toolbar 1.1.41
cpe:/a:google:toolbar:1.1.43Google Google Toolbar 1.1.43
cpe:/a:google:toolbar:1.1.48Google Google Toolbar 1.1.48
cpe:/a:google:toolbar:1.1.42Google Google Toolbar 1.1.42
cpe:/a:google:toolbar:1.1.47Google Google Toolbar 1.1.47
cpe:/a:google:toolbar:1.1.49Google Google Toolbar 1.1.49
cpe:/a:google:toolbar:1.1.45Google Google Toolbar 1.1.45
cpe:/a:google:toolbar:1.1.56Google Google Toolbar 1.1.56

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1443
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1443
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200304-079
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/5426
(VENDOR_ADVISORY)  BID  5426
http://online.securityfocus.com/archive/1/286527
(VENDOR_ADVISORY)  BUGTRAQ  20020808 Exploiting the Google toolbar (GM#001-MC)
http://toolbar.google.com/whatsnew.php3
(UNKNOWN)  CONFIRM  http://toolbar.google.com/whatsnew.php3
http://sec.greymagic.com/adv/gm001-mc/
(UNKNOWN)  MISC  http://sec.greymagic.com/adv/gm001-mc/
http://xforce.iss.net/xforce/xfdb/10054
(UNKNOWN)  XF  google-toolbar-keypress-monitoring(10054)
http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0066.html
(UNKNOWN)  NTBUGTRAQ  20020808 Exploiting the Google toolbar (GM#001-MC)

- 漏洞信息

多个供应商工具栏按键监测信息泄露漏洞
中危 设计错误
2003-04-11 00:00:00 2005-10-12 00:00:00
远程  
        Google工具栏1.1.58及其早期版本存在漏洞。远程web网站借助"onkeydown"项目处理器监测用户对工具栏的输入。

- 公告与补丁

        An updated version of the toolbar is available at
        http://toolbar.google.com/. Users may also upgrade through the Google Toolbar automatic update feature.

- 漏洞信息

10025
Google Toolbar onkeydown Event Handler User Input Disclosure

- 漏洞描述

Unknown or Incomplete

- 时间线

2002-08-08 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Multiple Vendor Toolbar Keypress Monitoring Information Disclosure Vulnerability
Design Error 5426
Yes No
2002-08-08 12:00:00 2009-07-11 02:56:00
Published by GreyMagic Software <security@greymagic.com>.

- 受影响的程序版本

Google Toolbar 1.1.58
Google Toolbar 1.1.57
Google Toolbar 1.1.56
Google Toolbar 1.1.55
Google Toolbar 1.1.54
Google Toolbar 1.1.53
Google Toolbar 1.1.49
Google Toolbar 1.1.48
Google Toolbar 1.1.47
Google Toolbar 1.1.45
Google Toolbar 1.1.44
Google Toolbar 1.1.43
Google Toolbar 1.1.42
Google Toolbar 1.1.41
AskJeeves Toolbar
Alexa Toolbar 6.5 .11775
Google Toolbar 1.1.60
Google Toolbar 1.1.59

- 不受影响的程序版本

Google Toolbar 1.1.60
Google Toolbar 1.1.59

- 漏洞讨论

The Google Toolbar is an ActiveX control for Microsoft Internet Explorer, which provides functionality related to the Google search engine.

It has been reported that keypress events in some versions of the Google Toolbar are also sent to the underlying browser window. A malicious script executing in the current browser window may monitor keypress events, and access whatever is typed into the toolbar.

Other search engine toolbars have been reported as being vulnerable to this issue. AskJeeves Toolbar, dated 18-Jul-2002, has been reported as being vulnerable. The Alexa Toolbar version 6.5.11775 has also been reported as being vulnerable.

- 漏洞利用

A sample exploit has been provided by GreyMagic Software &lt;security@greymagic.com&gt; at the following location:

http://sec.greymagic.com/adv/gm001-mc/

- 解决方案

An updated version of the toolbar is available at http://toolbar.google.com/. Users may also upgrade through the Google Toolbar automatic update feature.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站