Yahoo site security issue addressed
Published: 24 Oct 2005 10:10 BST
Yahoo has fixed a security flaw in its free Web-based email service that opened the door to phishing scams, account hijacks and other attacks.
The cross-site scripting vulnerability existed because Yahoo's Web site did not detect certain script tags in combination with certain special characters, according to SEC Consult, which issued an advisory on Friday.
Cross-site scripting flaws are found regularly, including recently in Google's Web site and earlier this year in Microsoft's Xbox 360 site.
Flaws have also been found on Yahoo's site. An attacker could exploit this type of flaw to hijack user accounts, launch information-stealing phishing scams or even download malicious code onto users' computers, experts have said.
A Yahoo representative said it fixed the most recent flaws in the "last few weeks" and that its users are protected.
"Yahoo recently learned of an issue in Yahoo Mail and worked immediately to begin rollout of a server-side fix which does not require users to take any action," said Karen Mahon, a Yahoo spokeswoman. "We are unaware of any users who were impacted by this issue."
Did you find this article useful?
38 out of 78 people found this useful
- Share this article:
