Dark Reading has the skinny on a new Gmail vulnerability that lets an attacker change a Gmail user’s password, wage a denial-of-service attack on the account, or even access other Gmail users’ email.
From the article:
The cross-site request forgery (CSRF) flaw — which researcher Vicente Aguilera Diaz from Madrid-based Internet Security Auditors first reported to Google in August 2007 — takes advantage of the way Gmail’s “Change Password” function operates. “The only token for authenticat[ing] the user is a session cookie, and this cookie is sent automatically by the browser in every request,” according to the vulnerability disclosure post.
An attacker can build a phony Web page that accepts requests for Gmail password changes, and then lets the attacker change the victims’ passwords without their knowing and evading CAPTCHA restrictions.
Google maintains that the flaw is not a major one because such an attack wouldn’t be easy to pull off.
See the original advisory on the vulnerability.
