Heads up users of Yahoo Mail. A cross-site scripting vulnerability has been discovered that could allow hackers to steal a user’s session IDs and ultimately private information, according to a report yesterday from security risk assessment firm Cenzic.
In an excerpt from the Cenzic blog post, the company reports:
“If the attacker is using the Yahoo! Messenger desktop application 8.1.0.209 to chat with the victim, and the victim is using the Messenger support in the new Yahoo! Mail Web application, it will cause a new chat tab to open in the victim’s browser. While chatting, the attacker can change their status to ‘invisible,’ causing a message of ‘offline’ in the chat tab of the victim. The vulnerability occurred when the attacker then changed status, and sent a custom message containing a malicious string in the form of a status message of ‘online,’ with the script executed in the context of Yahoo! Mail on the victim’s machine. This allowed an attacker to get active access to the victim’s session ID, and in turn steal their Yahoo! identity, exposing sensitive personal information stored in their Yahoo! account.”
Cenzic immediately reports such vulnerabilities, when discovered, to at-risk vendors that subscribe to its services. Yahoo was alerted to the flaw in May, according to Cenzic, and reports that as of June 13 the vulnerability has been eliminated.
This vulnerability was reported by Mandeep Khera, Cenzic’s vice president of marketing. Khera serviced in similar roles at security giant VeriSign, Maaya, a Web-services support company.