Slashdot Mirror

← Back to Stories (view on slashdot.org)

Yahoo and Hotmail Filter Flaw

Posted by CowboyNeal on from the shields-up-and-drop-to-impulse dept.

gandam writes "Israeli computer security firm GreyMagic Software has detected a serious security flaw in Yahoo's Web e-mail service and Microsoft Corp.'s Hotmail service, which could allow hackers to run malicious scripts on users' computers. I tried sending a mail to my yahoo account and it never reached my mailbox. According to the website, all attempts to contact Yahoo unfortunately failed. Mail was sent to security and secure at yahoo.com and at yahoo-inc.com. No replies were received to date. Works only in IE5, though."

3 of 250 comments (clear)

  1. I probably should point out... by Klatoo55 · · Score: 4, Interesting

    That Yahoo and Hotmail are pretty much the most used/spammed services out there, and therefore will have their security holes pinponted sooner than lesser-known services. Doesn't mean that the lesser knowns are more secure, just blissfully ignorant. Something to ponder...

    --
    ------- "A true friend stabs you in the front." -Eliot
  2. What about IMP and squirrelmail? by whoever57 · · Score: 4, Interesting

    Do they also need fixes?

    --
    The real "Libtards" are the Libertarians!
  3. Version numbers are almost meaningless by Prof.+Pi · · Score: 4, Interesting
    IE5 and IE5.5 are different in more than minor version number, while IE6 is pretty much IE5.5.1.

    When I worked for a VLSI team in Boston in the late eighties, our CAD vendor had a support contract which promised one major release a year. But it was almost a year since version 4.0, and their new release wasn't ready. So they just patched their latest release (4.2) with some bug fixes and a few minor features, and shipped it as 5.0. Everyone could see it was basically the same as 4.0 + patches.

    When version 5.1 came out a few months later, that was a huge change over 5.0! They replaced their standard menu-for-newbies + hotkeys-for-experts interface with the most hideous UI I've ever had the misfortune of using. It was based on "mouse gestures." You were supposed to "draw" a D with your mouse to delete a selected object, for instance. Half the time it would get the wrong gesture. Our productivity dropped precipitously, but because the 5.0 release had been rushed, there were bugs that were fixed in 5.1 and we couldn't work with the 5.0. So many customers complained that they quickly came out with 5.2, which was just 5.0 with the known bugs fixed.

    So I've learned that the positions of the digits don't necessarily mean anything. Hell, you can't even assume monotonicity all the time!