Google Fixes Security Flaws in Search Toolbar

A series of security holes in the Google Toolbar, an application offered by the popular search engine that adds easily accessible search features to Web browsers, could allow an attacker to read files, reroute searches, and execute scripts on an affected PC, according to a security alert released Thursday by GreyMagic Software.

GreyMagic identified a total of nine vulnerabilities ranging from minor--a Web site operator being able to tell what keys a user is pressing in the Google search field--to serious--the scripting vulnerability.

Fixing the Flaws

The flaws were all patched by Google's automatic update to the toolbar which was released on Wednesday, meaning that many Google Toolbar users should have already had their software updated to protect against the holes, GreyMagic says.

GreyMagic found the vulnerabilities in version 1.1.58 of the toolbar. Google is already distributing versions 1.1.59 and 1.1.60 which fix the problems, GreyMagic says.

Among the less serious flaws found is the search bar keylogging described above, enabling the "Page Rank" and "Category" features which could reveal user information, clearing the toolbar's history or even uninstalling the application, the Israeli GreyMagic says.

Serious Concerns

More seriously, by using a specific URL an attacker could reroute searches through his or her own Web site, allowing the attacker to log information about the user, the security group writes.

By using other URLs containing scripts, an attacker can read files on the affected PC or execute scripts in the same security context that Web pages are viewed, GreyMagic writes.

Users can check to see what version of the Google Toolbar they are running by clicking on the Google logo in the Toolbar and selecting "About Google Toolbar." The Google Toolbar can be downloaded from http://toolbar.google.com.