Feeds

Yahoo! Mail! vuln! fixed!

Buddy hacker account compromise risk plugged

  • alert
  • submit to reddit

High performance access to file storage

Yahoo! has fixed a vulnerability that left users of its popular webmail service at risk of having their login credentials stolen.

The cross-site scripting flaw, which allowed session IDs to be be stolen, involves the interaction between Yahoo! mail and the Yahoo! Messenger instant messaging client. The flaw was discovered in May by researchers at web application security firm Cenzic who worked with Yahoo! in resolving the problem.

Yahoo! fixed the vulnerability on 13 June, allowing Cenzic to publish a detailed advisory on the problem. The advisory (below) explains that miscreants would have first had to establish "buddy" status with their intended victims before carrying out the attack, which only worked were a Yahoo! mail user had configured Messenger support.

If the attacker is using the Yahoo! Messenger desktop application 8.1.0.209 to chat with the victim, and the victim is using the Messenger support in the new Yahoo! Mail Web application, it will cause a new chat tab to open in the victim’s browser. While chatting, the attacker can change their status to "invisible" causing a message of "offline" in the chat tab of the victim.

The vulnerability occurred when the attacker then changed status, and sent a custom message containing a malicious string in the form of a status message of "online", with the script executed in the context of Yahoo! Mail on the victim’s machine. This allowed an attacker to get active access to the victim’s session ID, and in turn steal their Yahoo! identity, exposing sensitive personal information stored in their Yahoo! account.

Ceznic's advisory on the vulnerability can be found here. Cross-site scripting flaws are a common class of web application vulnerability that has affected other webmail services including Gmail in the past. ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.