This is not dangerous from remote, because the "res:" protocol is not
accessible by internet zone. You must to find a way to access "res:" from
remote, otherwise it means nothing. As for local zone, you can ran scripts
in mycomputer zone.

Rafel Ivgi, The-Insider
Security Consultant, Finjan.com

----- Original Message -----
From: "ViPeR" <viper31337 (at) yahoo.co (dot) in [email concealed]>
To: <news (at) securiteam (dot) com [email concealed]>; <bugtraq (at) securityfocus (dot) com [email concealed]>;
<bugs (at) securitytracker (dot) com [email concealed]>; <vulnwatch (at) vulnwatch (dot) org [email concealed]>;
<vuln (at) security.nnov (dot) ru [email concealed]>; <sec-adv (at) secunia (dot) com [email concealed]>;
<submissions (at) packetstormsecurity (dot) org [email concealed]>
Sent: Friday, September 17, 2004 10:51 AM
Subject: GoogleToolbar:About -- Allows Script Injection

Affection Software : GoogleToolbar
Version : Tested on 2.0.114.1-big/en (GGLD)

Notes:
GoogleToolbar's About section allows injection of
script, since it lacks any checking. The following
code is a Proof Of Concept.

<s c r i p t>
window.showModalDialog("res://C:\\Program%20Files\\Google\\GoogleToolbar
1.dl
l/ABOUT.HTML",
"<div style=\"background-image:
url(javascript:alert(location.href));\">");
</s c r i p t>

rgds,
Gregory R. Panakkal / Viper

________________________________________________________________________

Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony

[ reply ]