Yahoo! 360° contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a Yahoo! Messenger or Yahoo! Profiles user has chosen to have their on-line status hidden. The Yahoo! 360° service does not honor these settings, and displays their on-line status to other Yahoo! 360° users which will disclose status information resulting in a loss of confidentiality.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Rumored
OSVDB:
Concern
Solution
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing one of the following workarounds: 1. Don't use Yahoo! Messenger stealth settings and select "Invisible to Everyone" on your status chooser. 2. Log in to Yahoo! 360° and edit your settings by unchecking the box listed as "Friend search: Yes, allow my friends to find me by my first/last name and email addresses selected above."
We currently have no CVSS2 data on this vulnerability. Feel free to suggest it.
Blogs
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
