Back to list
MVSA-10-002 - Google Message Security SaaS - Multiple XSS vulnerabilities
Sep 15 2010 08:24PM
marian ventuneac gmail com
Security Advisory: MVSA-10-002
Service: Google Message Security SaaS (powered by Postini)
- Security Console (Admin Console)
- Message Center Classic
- Message Center II
Vulnerabilities: Multiple Cross-Site Scripting (XSS)
Attack Vector: From Remote
Multiple persistent and reflected Cross-Site Scripting (XSS) vulnerabilities were identified in Security Console (Admin Console), Message Center Classic and Message Center II services of Google Message Security (powered by Postini).
When exploited, the identified vulnerabilities could lead to Session Hijack, Information Disclosure, force installation of malicious file or Trojan on users' PCs, etc.
Security Console (Admin Console)
Additionally, an effective DoS attack can be mounted against the organization's administrators by injecting malicious code which prevents the Web user interface to render properly.
* Reflected XSS: multiple parameters of /exec/admin_list resource
* Reflected XSS: multiple parameters of /exec/admin_auth resource.
Message Center Classic
* Reflected XSS: parameters add-good_address and add-bad_address of /exec/MsgSet resource.
* Reflected XSS: parameters msgid and disp parameters of /exec/MsgCtr resource.
Message Center II
* Reflected XSS: parameters id and source_uri of /msgctr/message_display resource.
Security Console build 6_24 (January 2010).
Message Center Classic build 6_24 (January 2010).
Message Center II build 6_24 (January 2010), build 6_25 (February 2010), build 6_26 (March 2010) and build 6_27 (April 2010).
Google fixed a first batch of vulnerabilities affecting Security Console and Message Center Classic in build 6_25 (February 2010).
Additional fixes were included in subsequent releases, with the last fixes added in build 6_29 (June 2010).
2010, January 24: Security Console and Message Centre II vulnerabilities discovered
2010, January 24: Notification sent to Google
2010, January 25: Google acknowledges the vulnerabilities
2010, February 22: Google deploys first set of fixes
2010, April 27: Additional vulnerabilities identified and notification sent to Google
2010, April 28: Additional vulnerabilities identified and notification sent to Google
2010, June 21: Google deploys additional fixes
2010, September 15: MVSA-10-002 advisory published.
Dr. Marian Ventuneac
[ reply ]
Copyright 2010, SecurityFocus