[ news_security_news ]
Serious Bug Found In Google Gmail
Rich Ord
Staff Writer
2005-01-12
 Insider Reports RSS Feed
HBX Networks has discovered a bug in Google Gmail that hackers could take advantage of to access private emails.
From HBX Networks:
"It all started about 3 days ago when MrYowler and I were working on a mailing list script to send out a batch of newsletters for a free hacker-friendly shell service we operate. We made the decision to keep it simple; a Perl script based upon the Net::SMTP CPAN module. Being the Perl guru that MrYowler is (shut up! people will start having expectations of me! ;-P), he had one whipped up in about 20 minutes. In the course of testing the script, we cranked out 10 newsletters to our GMail inboxes. We were a little shocked with that happened next.
MrYowler opened up his mailbox, and noticed the email had arrived just fine. He clicked on the subject line, and as expected, the message showed correctly. However, when he clicked the "Show options" link, the "Reply To" field in the email header that GMail displayed contained what appeared to be HTML code! Upon further inspection, we realized that it was the message body of another person's HTML-formatted email message.
Wondering if something had happened during the message transmission, we viewed the message source via GMail's "Show original" link. In the source, we did not see any of the HTML code that GMail was showing us. No HTML at all, as we did not even use it in our newsletter. It appeared as a regular run-of-the-mill plain text message.
We became curious as to what had gone wrong, and whether it was an error in the script, or in the GMail messaging system. We examined the the output of our Perl script, and discovered that it was not transmitting the "From" header (in the message body) correctly - the trailing ">" character was missing in the address area.
Where it should have been "From:", we had "From:
This, apparently, was enough to get GMail to provide us with some portion of someone else's messages."
Please read their full post on the Gmail bug they discovered. They include multiple screen captures illustrating the bug.
About the Author:
Rich Ord is the CEO of iEntry, Inc. iEntry owns over 200 websites and email newsletters generating over 200 million email/web views per month. Rich founded NewsLinx.com and the entire article linking concept, often referred to as news aggregation. Rich later became Director of Email Operations for internet.com, the largest technology and IT publisher on the internet.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
