A vulnerability has been discovered in Skype, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in Skype4COM.dll within the "skype4com" URI handler when processing short strings. This can be exploited to cause a limited heap-based buffer overflow as a longer string may be copied into a heap-based buffer previously allocated based on the length of the supplied URI.

Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious website.

The vulnerability is confirmed in Skype 3.5.0.239. Other versions prior to 3.6.0.216 may also be affected.

Solution
Update to version 3.6.0.216 or later.

Provided and/or discovered by
Reported by an anonymous person via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Skype (SKYPE-SB/2007-003):
http://www.skype.com/security/skype-sb-2007-002.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-070.html

Deep Links
Links available to Secunia VIM customers