Google: loads of new bugs

In services and products of Google on Monday, September, 24th, 2007, three vulnerabilities allowed the malefactor to execute an any code written in language JavaScript on behalf of a site and to steal requisites of registration record, kept in cookies have been found out, and in one case - to steal photos from online-storehouse. Vulnerability to between-sites scripting (CSS/XSS) have been found out in Google Groups, the search machine and Picasa.

Vulnerability in Google Groups to which at once there was a set of exploits, stealing requisites of access to GMail and sending contents of all mail box, has been eliminated. Exploites worked in four most known browsers: IE, Firefox, Opera and Konqueror. That vulnerability has worked, the victim should pass on specially generated URL, being in mail box GMail.

The second vulnerability of the same type is found out in search machines Google. Exploites, published in Mustlive blog, allowed to steal authentification cookies by means of specially generated URL, the leader on site ICANN and University of York.
The first has been eliminated ICANN, and the second while operates. Search in Google has shown, that approximately 200 thousand sites can be used for attack.

The third vulnerability allows to steal photos with Picasa, having enticed a victim on nocuous a web-page. Though in a basis lays between-sites scripting, for successful attack it is necessary a little making: use Flash, unreliability in URI proceeder and a fake of inquiries at data exchange between appendices. Vulnerability is not eliminated yet, however complexity of its operation will stop hackers for some time.

The previous large batch of bugs in Google has been found out in the end of May - the beginning of June. Then four vulnerabilities to between-sites scripting have existed for a week after detection.

Bug in Google Mail

There was an information about new vulnerability in Google web-mail which allows to organize interception of letters of the user privately. Known researcher Petko Petkov GNU Citizen has found out a bug, by the information from his blog having redirected logined Gmail user on a special site it is possible to create the filter which automatically will forward all messages with attachments on a mail box of the burglar in the mail.

Vulnerability is connected with the wrong data processing, transferred in forms (multipart/form-data POST). Petrkov has not laid out exploit for this vulnerability, however the colleague to whom hw showed breaking Gmail, confirm existence especially marking danger of a such mistake - " exploit works without any interaction with the user and it is absolutely imperceptible, it will be difficult to average user to notice, that its mail steal ". Google is engaged in studying of a mistake.

Google has demanded to carry out reforms in the patent legislation

Google company has demanded to carry out reforms in the patent legislation of the USA, to exclude cases of judicial claims from the various companies with the purpose to receive profit, using imperfection of laws. It is said in the official blog of Google by Michel Li (Michelle Lee), the chapter of a department of patents and patent strategy of the company, and Johanna Shelton, main Google lawyer.

As they said, the patent legislation of the USA is the extremely imperfect and because of it many large companies working in sphere of high technologies have to spend huge money for proceedings.
Possibly, the reason of such application is the last judicial claim from company Polaris IP which has accused Internet-companies among which Google, Yahoo! And Amazon, in illegal use of the patent for technology of processing e-mail messages.

Gmail is forbidden in Germany

According to the decision of court, Google cannot use name Gmail in Germany as it breaks trade mark G-mail belonging businessman Daniel Girsh. As specify in Google, the judicial verdict will not prevent to give service of Web-mail in the country which will be offered by the company under name Google Mail. Under the same name Gmail operates in the Great Britain where also was a corresponding brand. Google has put service of Web-mail into operation in 2004, and for today owns trade mark Gmail more than in 60 countries. According to representatives of the company, after promulgation by court of its reasons in favour of decision-making against Gmail in Google still can try to appeal against an interdiction in the Supreme court of Germany. As Girsh informed, he has registered trade mark G-mail in 2000, but Google conducts judicial struggle last three years. Under brand G-mail, as he said, he offers "hybrid" service which unites usual post and e-mail.