also @ TechSpot: Nvidia GeForce GTX 780 Review

› ›

Google patches more flaws in search app

By Derek Sooman

On November 23, 2005, 7:22 PM

Several serious security flaws in Google Mini have been patched, including some that could allow attackers to execute malicious code, carry out cross-site scripting or a port scan, or discover files on the target system. Google Mini is a hardware search appliance used by medium-sized enterprises and departments within large companies, and is a scaled-down version of the enterprise-oriented Google Search Appliance.

The danger originates with a feature in some versions of the appliance allowing a remote URL to be supplied as the path for an XSLT style sheet, used to customise the search interface, Metasploit said. "The Google Search Appliance search interface uses the 'proxystylesheet' form variable to determine what style sheet to apply to the search results. This variable can be a local file name or a HTTP URL," the organisation said in its advisory.

Input to the "proxystylesheet" parameter isn't properly sanitised, allowing attackers to execute malicious script code, what's known as a cross-site scripting attack, Metasploit said. This can be carried out via the appliance's error message system, or via a malicious XSLT style sheet.
Google claims to have been quite responsive and quick to deal with these issues, an attitude shared by HD Moore of the Metasploit Project who reported the bugs.

No tags on this story

Post a comment

Post a new comment

Social Login & Guest Posting TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.
TechSpot on:

Most Popular

Trending Featured
More Trending Topics

Featured on Laptops

Downloads and Drivers

Downloads   Drivers  

KiTTY 0.62.2.3

mIRC 7.32

Actual Bookmarks 1.2

World of Warcraft Patch 5.3.0

Funny Photo Maker 2.4.1

More Downloads

Latest Discussion

Watercooling Setup Linking together help 11 replies on Overclocking, Cooling and Modding

How did my Windows key become disabled? 18 replies on Other Hardware

What's the difference between DDR3 memory and GDDR5 memory? 21 replies on Processors and Motherboards

Wireless capability keeps turning off 21 replies on Storage and Networking

Need advice on router-buy 10 replies on Storage and Networking

More Recent Discussion

Subscribe to TechSpot

Get free exclusive content, learn about new features and breaking tech news.