|
Brought to you by:
Suppliers of:
|
|
|
| |
Skype is "free Internet telephony that just works. Skype is for calling other people on their computers or phones".
Due to improper handling of user provided command line data, a remote attacker can trick a user to click on a URL that would execute arbitrary code under the privileges with which Skype runs. |
| |
Credit:
The information has been provided by Anonymous.
|
| |
Vulnerable Systems:
* Skype versions 1.0.*.95 through 1.0.*.98
Immune Systems:
* Skype versions 1.0.0.100
Vendor status:
A new version of the product can be downloaded from: http://www.skype.com/products/skype/windows/
Technical details:
The buffer overflow happens when a Skype user clicks on a "callto://username" link with a username longer then 4096 characters that does not exist: An error message is created and put into a buffer without correct size checks. The error message and buffer are Unicode however, Unicode characters are filtered out and replaced with '?'. Only printable ASCII characters seem to get through. A return address can be overwritten as well as the SEH. Exploitation is complicated by the fact that return addresses have to be in range 0x00??00??.
Web browsers like Microsoft Internet Explorer do not support URI's long enough to trigger the BoF. To exploit it, one could send a Skype user a callto:// link in a private message and trick him/her into clicking it.
|
|
|
|
|
