Security researchers have discovered a serious flaw in Google’s desktop software that could be used to wreak havoc on a victim’s computer.
The bug, which was made public Wednesday by Watchfire, has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google spokesman Barry Schnitt via e-mail.
Google was first notified of the problem on Jan. 4, and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday.
In addition to its bug fix, Google has added “another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future,” Schnitt said. “We have received no reports that this vulnerability was exploited,” he added.
For this attack to work, the criminal would have to first go through a number of steps, including hacking Google.com to find a cross-site scripting vulnerability on the website—something that has been done several times in the past year, according to Watchfire.
If successful, however, the attack would be devastating. A criminal could search for anything on the computer or even take over the victim’s computer by tricking Google desktop into running malicious software stored on another computer, Watchfire claims.
-Robert McMillan, IDG News Service (San Francisco Bureau)