Yahoo Cross-site scripting flaws now fixed

Discussion in 'other security issues & news' started by Newkid, Aug 20, 2004.

Thread Status:
Not open for further replies.
  1. Newkid

    Newkid Spyware Fighter

    Joined:
    Apr 29, 2004
    Posts:
    225
    Location:
    Memphis
    Yahoo fixed two flaws in its free mail system that could have allowed a malicious user to read a victim's browser cookies and change the appearance of some pages, Yahoo said today.

    They were alerted of it at the end of May, early June by some good soul.

    The vulnerabilities are of a type known as cross-site scripting flaws, which typically take advantage scripting languages and misconfigured Web servers to launch attacks against a user's computer. The attacks typically redirect the user to another Web site, allow access to the user's cookies or, sometimes, allow the attacker to run code on the victim's computer.

    Yahoo fixed the flaws in its server code. No patch is required by the Yahoo Mail users.
     
Loading...
Thread Status:
Not open for further replies.