Title: Google Talk Denial of Service - BenjiBug Reported Date: October 15, 2005 Public Disclosure: November 22, 2005 Status: Vendor contacted. Unpatched. Software which automatically updates itself is often a good idea - especially where home users are concerned. It is often impossible to patch their systems otherwise. But automatic update mechanisms must be designed and implemented in ways which prevent malicious attackers from installing malware. Google Talk includes the ability to automatically update itself - a feature which cannot be disabled. Google Talk connects at random intervals (about once every day or so in testing) to dl.google.com via HTTP and fetches a .txt file (http://dl.google.com/googletalk/google-talk-versioncheck.txt) which lists the current version of Google Talk, as well as a digital signature of the new installer executable. If the version number is greater than the version currently running, Google Talk will download the .exe and, after checking its authenticity, execute it to automatically update. Assuming a user's DNS cache can be poisoned, a denial of service attack is possible. Thanks to the digital signature, malware will not execute. Yet, it is possible to force Google Talk to download a large file which it will then analyze to determine whether the signature matches. This will consume 100% CPU and large amounts of memory, resulting in an unstable machine which requires a reboot in some cases. It is also possible to plant incriminating files on a user's machine, as the files are at first downloaded and saved to the "Temporary Internet Files" directory before they are verified and moved to Google Talk's data directory. Google can patch this by checking the file size of the downloaded executable to ensure that it is within the range of a normal updater .exe. Addendum: Although Launch-Target can be manipulated to cause Google Talk to execute a file other than the one downloaded from the URL field, it will not execute files outside of the C:\Program Files\Google\Google Talk\googletalk-[version] directory, so this seems useless as an attack vector. Google Talk's request to Google's servers is as follows: GET /googletalk/google-talk-versioncheck.txt?auv=1&r=4&up=30&p=w&ma=5&mi=1&b=2600&sp=ServicePack2&as=googletalk&pv=1.0.0.76 ma = major version number, mi = minor version number, b = build -James Evans
