Google plugs account hijack holes

If left unpatched, the vulnerability could let hackers modify third-party documents and view e-mail subjects, search history.

Google has patched a cross-site scripting vulnerability in one of its Web-hosting services.

If left unpatched, the cross-site scripting (XSS) vulnerability could have allowed hackers to modify third-party Google documents and spreadsheets and to view e-mail subjects and search history, according to the Google Blogoscoped blog.

Philipp Lenssen, the author of Google Blogoscoped, a third-party site that comments on Google developments, said the vulnerability was similar to another in Blogger Custom Domains reported on Sunday night.

"The security hole is connected to an update to a specific Google service which doesn't correctly defend against HTML injections," he said.

According to Lenssen, the earlier Custom Domains vulnerability allowed another Google expert, Tony Ruscoe, to create a page that was hosted on a Google.com domain. Ruscoe was able to prove that he could have used code to steal a user's Google cookie and access their Google services.

The second vulnerability, reported by Lenssen, would also have enabled a hacker to use JavaScript code to pass cookie data to an external source.

Google addressed both vulnerabilities, a representative for the Mountain View, Calif., company said in an e-mailed statement Tuesday.

"Google was alerted to these issues, and we worked quickly to fix the problems, which have been resolved," the representative said. "We have not received any reports of user data being compromised."

Additionally, Google called upon bug hunters to report security issues directly to the company so it has time to craft a fix before word of the flaw gets out to the public. This "responsible disclosure" is advocated by Web and software companies alike, but security researchers increasingly balk at it.

Tom Espiner of ZDNet UK reported from London. CNET News.com's Joris Evers contributed to this report from San Francisco.

Featured Video
6
This content is rated TV-MA, and is for viewers 18 years or older. Are you of age?
Sorry, you are not old enough to view this content.

Man flies 54-propeller superdrone, almost flips it, Ep. 217

This week on Crave, we walk you through a futuristic new automated restaurant in San Francisco, get navigation directions from the sultry voice of Stephen Colbert on Waze, and fly a drone with 54 propellers that can carry a full-grown man. It's the Crave show!

by Stephen Beacham