Risk: Informational
A mass mailing worm has been circulating through Yahoo!'s email service, which was activated when a victim opens the email. Symantec called the worm JS.Yamanner@m and says that it differed from traditional worms, as it was not contained in an attachment. The worm was written in Javascript and exploited a flaw that enables scripts embedded in HTML email to run in the user's browser.
The worm spread by sending itself to a victim's contacts with email suffixes of @yahoo.com or @yahoogroups.com and sent the harvested email addresses to a remote server.
Yahoo! users were advised to block emails sent from av3@yahoo.com and not open any emails with "New Graphic Site" in the subject line. A fix was emailed to all Yahoo! users on 15th June.