Google Talk: Unpatched DoS Vulnerability Disclosed


Software which automatically updates itself is often a good idea - especially where home users are concerned. It is often impossible to patch their systems otherwise. But automatic update mechanisms must be designed and implemented in ways which prevent malicious attackers from installing malware. Google Talk includes the ability to automatically update itself - a feature which cannot be disabled. Google Talk connects at random intervals (about once every day or so in testing) to dl.google.com via HTTP and fetches a .txt file (http://dl.google.com/googletalk/google-talk-versioncheck.txt) which lists the current version of Google Talk, as well as a digital signature of the new installer executable. If the version number is greater than the version currently running, Google Talk will download the .exe and, after checking its authenticity, execute it to automatically update.

Assuming a user's DNS cache can be poisoned, a denial of service attack is possible. Google Talk Denial of Service - BenjiBug - addict3d.org

Linked by shanmuga Tuesday, 22nd November 2005 11:04PM