nVidia.com [Url Redirection flaw]

[Lorenzo Vogelsang <vogelsang.lorenzo () gmail com>]

Hi all, i'm new to the list. I'm an italian student who likes security
topics in the I.C.T world..

Browsing the nVdia web sites, i have found a very basic Url redirection
flaw. Infact when downloading a driver i get Urls like this:


http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=http://us.download.nvidia.com/Windows/179.48/179.48_notebook_winxp_64bit_beta.exe

and connecting to this another Url


http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=http://www.google.it


will redirects succefully to www.google.it! (or other web site of your
choice , or downloadble content..)


Enjoy!

Lorenzo Vogelsang.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/