A vulnerability has been reported in Skype, which can be exploited by malicious people to bypass certain security restrictions and potentially disclose certain sensitive information.

The vulnerability is cause due to an error within the parsing of the parameters passed by the URI handler. This can be exploited to inject additional command line switches to the Skype client to initiate transfer of a file from one Skype user to another via a specially crafted Skype URL, without requiring the sender to explicitly consent the action.

Successful exploitation requires that the user follows a malicious Skype URL and that the recipient has previously authorised the sender.

The vulnerability has been reported in the following versions of Skype for Windows.
* Release 2.0.*.104 and prior
* Release 2.5.*.0 through 2.5.*.78

Solution
Update to the fixed versions.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Brett Moore of Security-Assessment.com Ltd.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Skype:
http://www.skype.com/security/skype-sb-2006-001.html

Security-Assessment.com:
http://www.security-assessment.com/Advisories/Skype_URI_Handling_Vulnerability.pdf

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers