A JavaScript worm that takes advantage of an unpatched vulnerability in Yahoo!'s webmail service has been discovered on the net.

The JS-Yamanner worm spreads when a Windows user accesses Yahoo! Mail to open an email sent by the worm. The attack works because of a vulnerability in Yahoo! Mail that enables scripts embedded within HTML emails to be run within a user’s browser instead of being blocked.

Once executed, the worm forwards itself to an infected users' contacts on Yahoo! Mail. It also harvests these address and sends them to a remote internet server. Only contacts with an email address of either @yahoo.com or @yahoogroups.com are hit by this behaviour.

Infected emails commonly have the subject line "New Graphic Site" and are spoofed so as to appear from "av3@yahoo.com". Users who open infected emails will be redirected to a webpage at www.av3.net/index.htm.

Symantec Security Response senior manager Kevin Hogan said: "Unlike its predecessors, which would require the user to open an attachment in order to launch and propagate, JS-Yamanner makes use of a security hole in the Yahoo! web mail program in order to spread to other Yahoo! users. Yahoo! is a popular email tool, and although normally closed to such threats, the exploitation of this vulnerability provides access to a significant number of internet users.

"As there is no patch at present, users are recommended to update virus definitions and firewall signatures and to block any emails sent from av3@yahoo.com." ®

Related stories

Buggy ActiveX controls menace Yahoo! Messenger (7 June 2007)
http://www.theregister.co.uk/2007/06/07/yahoo_activex_bug/
JavaScript in web browsers is new security weak spot (17 May 2007)
http://www.theregister.co.uk/2007/05/17/fortify_java_security/
Worm feasts on latest Windows vuln (14 August 2006)
http://www.theregister.co.uk/2006/08/14/cuebot_worm_targets_ms_vuln/
Kama Sutra worm crashes malware chart (1 February 2006)
http://www.theregister.co.uk/2006/02/01/january_virus_chart/
Web 2.0 worm downs MySpace (17 October 2005)
http://www.theregister.co.uk/2005/10/17/web20_worm_knocks_out_myspaces/
Download.Ject-style worm spreads via IM (20 August 2004)
http://www.theregister.co.uk/2004/08/20/im_worm/