
Quick fix?
By Joris Evers
Published: 24 October 2005 09:05 BST
Yahoo! has fixed a security flaw in its free web-based email service that opened the door to phishing scams, account hijacks and other attacks.
The flaw, known as a cross-site scripting vulnerability, existed because Yahoo!'s website did not detect certain script tags in combination with certain special characters, according to SEC Consult, which issued an advisory on the flaw Friday.
Cross-site scripting flaws are found regularly, including recently in Google's website and earlier this year in Microsoft's Xbox 360 site.
Flaws have also been found on Yahoo!'s site. An attacker could exploit this type of flaw to hijack user accounts, launch information-stealing phishing scams or even download malicious code onto users' computers, experts have said.
A Yahoo! representative said the company fixed the most recent flaws in the "last few weeks" and that its users are protected.
A Yahoo! spokeswoman said: "Yahoo! recently learned of an issue in Yahoo! Mail and worked immediately to begin rollout of a server-side fix which does not require users to take any action.
"We are unaware of any users who were impacted by this issue."
Joris Evers writes for CNET News.com
Yahoo! told to Flickr right off
Fake Yahoo! website running ID theft scam
Yahoo! piggybacks uninvited extras with new IM
Yahoo! 'helped China jail journalist for state secret leak'
Yahoo! set to launch podcast search service
Yahoo! and Microsoft set for IM love-in?
Apache, youll have extensive knowledge of HTML and cross-platform compatibility issues, and an understanding of the factors affecting download speeds ...
Responsibilities: - Deliver security assessment services including network scanning, vulnerability testing, penetration testing, search engine ...
Key skills required include: CSS, AJAX and PHP scripting, Expert knowledge of Google Adwords for PPC campaign management, Administration of Linux and ...
CIO50 2008
The silicon.com CIO50 2008 profiles the most influential and innovative tech chiefs in the UK across all industries and organisation size, from the biggest FTSE100 companies to high growth dot-com start ups and the public sector. The list was voted on by the UK CIO community and a panel of experts. Find out more in our latest special report.
Stories from the web...
Copyright ©1995-2008 CNET Networks, Inc. All rights reserved. Top of page
Peter Cochrane Peter Cochrane's Blog: Is convergence a fiction? Or could it finally be happening…
Clive Longbottom Quocirca's Straight Talking: A game of two halves Microsoft Virtualisation scores while its SOA bores...