Gmai Flaw Lets Attacker Cotrol "change Password" Function

[Peaches]

New Gmail Flaw Lets Attacker Control 'Change Password' Function Cross-site request forgery (CSRF) vulnerability lets an attacker change Gmail user passwords and hack Gmail accounts -- but Google says it's tough to exploit

Mar 03, 2009 | 01:37 PM

By Kelly Jackson Higgins

DarkReading

A researcher today released a proof-of-concept for a vulnerability he discovered in Google Gmail that lets an attacker change a Gmail user's password, wage a denial-of-service attack on the account, or even access other Gmail users' email.

The cross-site request forgery (CSRF) flaw -- which researcher Vicente Aguilera Diaz from Madrid-based Internet Security Auditors first reported to Google in August 2007 -- takes advantage of the way Gmail's "Change Password" function operates. "The only token for authenticat[ing] the user is a session cookie, and this cookie is sent automatically by the browser in every request," according to the vulnerability disclosure post.

An attacker can build a phony Web page that accepts requests for Gmail password changes, and then lets the attacker change the victims' passwords without their knowing and evading CAPTCHA restrictions.

Google maintains that the flaw is not a major one because such an attack wouldn't be easy to pull off.

http://www.darkreading.com/security/vulner...cleID=215800241

>>>>>>>>>>>>>>>>