Vulnerabilities > CVE-2008-6512 - Unspecified vulnerability in Google Gears

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
google
NVD
Published: 2009-03-24
Updated: 2017-08-17

Summary

Cross-domain vulnerability in the WorkerPool API in Google Gears before 0.5.4.2 allows remote attackers to bypass the Same Origin Policy and the intended access restrictions of the allowCrossOrigin function by hosting an assumed-safe file type containing Google Gear commands on the target domain, then accessing that file from the attacking domain, whose response headers are not checked and cause the worker code to run in the target domain.

Vulnerable Configurations

Part Description Count
Application
Google
5

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 32698 CVE(CAN) ID: CVE-2008-6512 Google Gears是一个开源浏览器扩展，允许开发者开发离线网络程序。 Google Gears的WorkerPool API中存在跨域安全漏洞。如果攻击者在目标域上放置了包含有Google Gear命令的文件类型，然后从攻击域访问该文件，由于没有检查攻击域的响应头，因此可能绕过allowCrossOrigin函数的访问限制在目标域中运行worker代码。 Google Gears &lt; 0.5.4.2 厂商补丁： Google ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://www.google.com target=_blank rel=external nofollow>http://www.google.com</a>
idSSV:4950
last seen2017-11-19
modified2009-03-25
published2009-03-25
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-4950
titleGoogle Gears WorkerPool API绕过同源策略漏洞

References