Yahoo email gets fix to nix sender-spoofing trickery - CNET

Enlarge Image

Yahoo has patched a vulnerability in its email service that allowed cyberattackers to spoof Yahoo email addresses.

The bug was discovered by independent researcher Lawrence Amer and published through Vulnerability Lab on Full Disclosure. On Monday, the security researcher released details of the flaw publicly, saying the sender-spoofing vulnerability affected the Yahoo webmail application.

Cyberattackers are able to remotely spoof the sender names of Yahoo email users through a vulnerability found within the "compose message" module of the Web service. A weakness in the system permits users to inject or intercept traffic in the POST/GET parameters, spoofing the email address to whatever sender name they wish.

This vulnerability is a problem as spoofed email addresses are often used in spear-phishing campaigns -- fraudulent emails sent for the purposes of information theft or to dupe victims into installing malware on their systems. If a user receives an email from a spoofed Yahoo address that seems legitimate, they may be more likely to fall for such a campaign.