UnderForge of Lack

[IN ZERO DAY]
Google Apps 1.1.110.6031 において googleapps.url.mailto を悪用したリモートコマンドの実行の脆弱性が指摘されています。
現時点ではゼロデイ状態です

Google Apps "googleapps.url.mailto" URI Handling Argument Injection
Google Apps 'googleapps.url.mailto' Handler Command Injection Vulnerability
※PoC有
Google Appsに未解決の脆弱性、悪用の恐れ

緩和策
[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto]
@="Google Apps URL"
"EditFlags"=hex:02,00,00,00
"FriendlyTypeName"="Google Apps URL"
"URL Protocol"=""

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\DefaultIcon]
@="C:\\Programmi\\Google\\Google Apps\\googleapps.exe,0"

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\shell]

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\shell\open]

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\shell\open\command]
@="C:\\Programmi\\Google\\Google Apps\\googleapps.exe --mailto.google.com=\"%1\""
のレジストリキーの削除

This entry was posted on 月曜日, 10 月 5th, 2009 at 9:38 PM and is filed under Announce, security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.