JavaScript worm targets Yahoo

12-06-2006

by The Register

A JavaScript worm that takes advantage of an unpatched vulnerability in Yahoo's webmail service has been discovered on the net.

The JS-Yamanner worm spreads when a Windows user accesses Yahoo Mail to open an e-mail sent by the worm. The attack works because of a vulnerability in Yahoo Mail that enables scripts embedded within HTML e-mails to be run within a user's browser instead of being blocked.

Once executed, the worm forwards itself to an infected users' contacts on Yahoo Mail. It also harvests these address and sends them to a remote internet server. Only contacts with an e-mail address of either @yahoo.com or @yahoogroups.com are hit by this behaviour.

Infected e-mails commonly have the subject line "New Graphic Site" and are spoofed so as to appear from "av3@yahoo.com". Users who open infected e-mails will be redirected to a webpage at www.av3.net/index.htm.

Symantec Security Response senior manager Kevin Hogan said: "Unlike its predecessors, which would require the user to open an attachment in order to launch and propagate, JS-Yamanner makes use of a security hole in the Yahoo webmail programme in order to spread to other Yahoo users. Yahoo is a popular e-mail tool, and although normally closed to such threats, the exploitation of this vulnerability provides access to a significant number of internet users.

"As there is no patch at present, users are recommended to update virus definitions and firewall signatures and to block any e-mails sent from av3@yahoo.com."

The Register and its contents are copyright 2006 Situation Publishing. Reprinted with permission.