Security researchers have discovered a serious flaw in Google Inc.’s desktop software that could be used to wreak havoc on a victim’s computer.
The bug, which was made public Wednesday by Watchfire Corp., has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt, via e-mail.
Google was first notified of the problem on Jan. 4, and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday.
In addition to its bug fix, Google has added, “another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future,” Schnitt said. “We have received no reports that this vulnerability was exploited,” he added.
Watchfire’s research underscores the danger of integrating Web-based applications with the desktop, the company said in a white paper, published Wednesday.
The flaw lies in a search parameter used by Google Desktop’s Advanced Search feature, which could be used to execute malicious JavaScript code, according to Watchfire.
For this attack to work, the criminal would have to first go through a number of steps, including hacking Google.com to find a cross site scripting vulnerability on the Web site — something that has been done several times in the past year, according to Watchfire.
If successful, however, the attack would be devastating. A criminal could search for anything on the computer or even take over the victim’s computer by tricking Google desktop into running malicious software stored on another computer, Watchfire claims.
