Title: Google Talk Denial of Service - BenjiBug
Reported Date: October 15, 2005
Public Disclosure: November 22, 2005
Status: Vendor contacted. Unpatched.
Software which automatically updates itself is often a good idea -
especially where home users are concerned. It is often impossible to
patch their systems otherwise. But automatic update mechanisms must be
designed and implemented in ways which prevent malicious attackers
from installing malware. Google Talk includes the ability to
automatically update itself - a feature which cannot be disabled.
Google Talk connects at random intervals (about once every day or so
in testing) to dl.google.com via HTTP and fetches a .txt file
(http://dl.google.com/googletalk/google-talk-versioncheck.txt) which
lists the current version of Google Talk, as well as a digital
signature of the new installer executable. If the version number is
greater than the version currently running, Google Talk will download
the .exe and, after checking its authenticity, execute it to
automatically update.
Assuming a user's DNS cache can be poisoned, a denial of service
attack is possible. Thanks to the digital signature, malware will not
execute. Yet, it is possible to force Google Talk to download a large
file which it will then analyze to determine whether the signature
matches. This will consume 100% CPU and large amounts of memory,
resulting in an unstable machine which requires a reboot in some
cases. It is also possible to plant incriminating files on a user's
machine, as the files are at first downloaded and saved to the
"Temporary Internet Files" directory before they are verified and
moved to Google Talk's data directory.
Google can patch this by checking the file size of the downloaded
executable to ensure that it is within the range of a normal updater
.exe.
Addendum: Although Launch-Target can be manipulated to cause Google
Talk to execute a file other than the one downloaded from the URL
field, it will not execute files outside of the C:\Program
Files\Google\Google Talk\googletalk-[version] directory, so this seems
useless as an attack vector.
Google Talk's request to Google's servers is as follows:
GET
/googletalk/google-talk-versioncheck.txt?auv=1&r=4&up=30&p=w&ma=5&mi=1&b=2600&sp=ServicePack2&as=googletalk&pv=1.0.0.76
ma = major version number, mi = minor version number, b = build
-James Evans
