Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »
Social Responsibility's Strategic Benefits
December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)
Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.
Working With and Communicating to Your Board of Directors
January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)
CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.
IT's Role in Growing Mid-Market Companies
January 14, 4:00 PM - 5:00 PM ET (GMT-5)
Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.
Learn more about the CIO Executive Council »
Apply today for a FREE subscription to CIO Magazine!
Yahoo Fixes E-Mail Cross-Site Scripting Flaw
Yahoo has fixed a vulnerability in its Web mail site that could allow a hacker to get access to a person's account.
June 25, 2008 — IDG News Service —
Yahoo has fixed a vulnerability in its Web mail site that could allow a hacker to get access to a person's account.
The problem was in the way Yahoo's Web mail interacts with version 8.1.0.209 of its instant messaging (IM) desktop application, according to Web application security company Cenzic.
Cenzic notified Yahoo of the problem in May, and the company fixed it on June 13.
If a hacker using the IM application starts chatting with a victim who is using the IM function of Yahoo's Web e-mail, a new chat tab is opened in the victim's Web browser. The attacker can then manipulate his presence status message to send a malicious script via IM. That script would then be executed in the context of Yahoo's e-mail service on the person's PC.
The script can reveal the victim's session ID to the attacker, who can then get access to information stored in that account, Cenzic said.
Cenzic classified the vulnerability as a cross-site scripting flaw, where scripts or commands from one Web application that shouldn't run in another are successfully executed. Security experts contend that cross-site scripting vulnerabilities are rampant on Web sites, posing dangerous risks to Web users.
Once in control of the account, the hacker could send spam. Yahoo and other free e-mail providers such as Microsoft have seen increasing use of their services for spam.
That's in part because the CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) security feature, which requires users to decode a jumble of distorted characters, has been increasingly defeated by machine-based processing.
The vulnerability would also allow access to a person's IM contacts. The hacker can then send instant messages purporting to be from a legitimate contact but with links leading to sites that try and exploit vulnerabilities in a person's Web browser or operating system.
Copyright © 2008 IDG News Service. All rights reserved. IDG News Service is a trademark of International Data Group, Inc.
The Intelligent Enterprise
Mobility is Growing: Survey Shows Why CIOs are Concerned
The Move Toward Mobilization
The Case for A Specialized Security Platform
Protecting the Code: Technology Escrows Safeguards Critical Software
Optimizing Infrastructure Control
Enabling the Global Enterprise
Get a grip on your mobile workforce Webcast
Save with 0% Lease Offer on HP Servers and Storage
The State of the Great Windows Vista Migration and the Latest Research on What Real Customers Say
Liberation through Automation: How You Can Automate Your PC Deployment and Help Free Up IT Resources
Windows Vista: Essential Benefits and Deployment Strategies
Resource Alerts
Get instant email notifications by topic when white papers, webcasts, and case studies are added to our library.
Clearwire woes hit big backers
Myspace comes to TV with Intel, Yahoo
New SD standard will allow for 2TB cards
Social networks link terrorists
Social networking, ROI, pricing among '09 CRM trends
Cutting costs, Microsoft backs away from office space
Sun buys cloud-computing vendor Q-layer
Borland CEO Joins VMware
LG adds wireless features to new LCD TVs
Verizon to include Microsoft Live Search on phones
Just the basics, please. Sometimes we all need a refresher or we need to make sure our team and our colleagues are all on the same page.
Over 25 tutorials on everything from business intelligence to virtualization.
- CIO|
- Computerworld|
- CSO|
- DEMO|
- Game Pro|
- Games.net|
- IDG|
- IDG UK|
- IDG Connect|
- IDG Tech Network |
- IDG World Expo|
- Industry Standard|
- InfoWorld|
- ITworld|
- JavaWorld|
- LinuxWorld|
- MacUser|
- Macworld|
- Network World|
- PC World|
- Playlist|
- CIO UK|
- CIO Germany|
- CIO China|
- CIO Sweden|
- CIO Australia|
- Other CIO Sites
