Skip to main content

GoogleApps "googleapps.url.mailto:" Argument Injection Vulnerability

Last Update Date: 28 Jan 2011 Release Date: 5 Oct 2009 4519 Views

RISK: Medium Risk

A vulnerability has been identified in Google Apps, which could be exploited by remote attackers to compromise a vulnerable system. This issue is caused by an error in the "googleapps.exe"application when processing parameters passed to the "---renderer-path" argument via the"googleapps.url.mailto:" URI, which could allow attackers to load an execute a malicious binary (e.g. bat or exe file) from a remote location (e.g. network share) by tricking a user into visiting a specially crafted web page, leading to arbitrary code execution.


Impact

  • Remote Code Execution

System / Technologies affected

  • Google Apps versions 1.x


Solutions

There is no patch available for this vulnerability currently.

Workaround

  • Do not visit untrusted websites or follow untrusted links.


  • Vulnerability Identifier

    • No CVE information is available

    Source


    Related Link