Google working to patch Gmail message-forwarding flaw

An attacker must force a potential victim, logged into their Gmail account, to visit a malicious page that injects a filter into the victim's filter list, according to researcher Petko Petkov of Gnucitizen. The filter sends emails with attachments to an address of the attacker's choice.

Classifying exploitation a cross-site request forgery, Petkov warned that even if Google releases a fix for the flaw, messages would still be forwarded to the third-party address because the filter is still present.

Petkov on Tuesday urged other researchers not to disclose details of the flaw until Google fixes it, saying the vulnerability is “extremely nasty if you ask me” on the Gnucitizen blog.

“If you find this vulnerability, please do not disclose it. Let Google fix it first and then blog about it,” he said. “In an age where all the data is in the cloud, it makes no sense for the attackers to go after your box. It is a lot simpler to install one of these persistent backdoor/spyware filters. Game over! They don't own your box, but they have you, which is a lot better.”

Petkov told SCMagazineUS.com today that Google replied to him, saying that they have “confirmed the vulnerability and now they are looking for ways to fix it.”

Google today released a statement saying that the company would issue a fix shortly.

“Google takes the security of our users' information very seriously, and we are working on a fix to the recently reported vulnerability, which we expect to be implemented shortly,” the Mountain View, Calif.-based search giant said in a statement.

Petkov this month also discovered a flaw in QuickTime and Firefox, and a vulnerability in Adobe Reader – both fixed by vendors last week.

See original article on SC Magazine US