Worm Targets Yahoo Mail Users

A worm that is exploiting a flaw within Yahoo Mail is currently making its way through the service, security firm Symantec warned on Monday. However, Yahoo has since offered a patch for the flaw, which it says affected only a vulnerability of its customers.

Called "Yamanner," the worm took advantage of a JavaScript issue within the client that affects all versions except for the current beta. It comes hidden in an e-mail titled "New Graphic Site" that when opened launches the worm.

From there, the worm spreads itself to all on the user's Yahoo contact list, along with sending those e-mail addresses to a remote server. In its advisory, Symantec said it believed this would later be used to spam those addresses.

Yahoo said in a statement that the issue had been repaired and the update automatically sent to all customers. Still, both Yahoo and Symantec said it still would be a good idea to ensure than virus definition files are up to date.

According to Symantec research, the remote server that the worm calls was hit approximately 100,000 times, giving an idea of the extent of the infection. The firm gave the worm a rating of "2" out of a five-level numerical rating system.

Symantec said it was too early to judge whether or not the attackers would attempt to alter the worm so it could infect other Web-based e-mail systems.