Mar 3, 2009
New Gmail flaw lets attacker control ‘Change Password’ function
A researcher today released a proof-of-concept for a vulnerability he discovered in Google Gmail that lets an attacker change a Gmail user’s password, wage a denial-of-service attack on the account, or even access other Gmail users’ email.
An attacker can build a phony Web page that accepts requests for Gmail password changes, and then lets the attacker change the victims’ passwords without their knowing and evading CAPTCHA restrictions. Read on.
Leave a Reply