|
 |
|
Skype Cross-Zone Scripting Security Enhancement
|
|
|
|
|
Secunia Advisory:
|
SA28791
|
|
|
Release Date:
|
2008-02-06
|
|
Last Update:
|
2008-02-14
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Skype for Windows 1.x
Skype for Windows 2.x
Skype for Windows 3.x
|
| | CVE reference: | CVE-2008-0582 (Secunia mirror)
CVE-2008-0583 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
An update has been released for Skype, which implements security enhancements to prevent compromise of users' systems.
Skype uses the Internet Explorer web control to render HTML from certain websites (e.g. DailyMotion, Metacafe, and SkypeFind). As the content is rendered in the "Local Machine" security zone, this allows execution of arbitrary script code on a user's system via script insertion vulnerabilities present in these websites.
Various vulnerabilities have been discovered in these sites, which provide vectors when a user e.g. uses the Skype video gallery browser section or finds a video uploaded to the DailyMotion gallery with a specially crafted video title.
Successful exploitation requires that a displayed website is vulnerable to script insertion.
The vulnerability is reported in the following Skype for Windows versions:
- All versions including 3.5.*
- Version 3.6.*.244 and prior
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Solution:
Update or upgrade to version 3.6.*.248 or later, which now runs the Internet Explorer web control in the "Internet" security zone.
http://www.skype.com/download/skype/windows/
Provided and/or discovered by:
Aviv Raff
Changelog:
2008-02-07: Added CVE reference.
2008-02-14: Added link to US-CERT.
Original Advisory:
Skype:
http://www.skype.com/security/skype-sb-2008-001-update2.html
http://www.skype.com/intl/en/security/skype-sb-2008-002.html
http://www.skype.com/intl/en/security/skype-sb-2008-001-update1.html
http://www.skype.com/intl/en/security/skype-sb-2008-001.html
Aviv Raff:
http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx
http://aviv.raffon.net/2008/01/31/AttackersCanSkypeFindYou.aspx
Other References:
US-CERT VU#794236:
http://www.kb.cert.org/vuls/id/794236
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
5 Related Secunia Security Advisories
|
|
|
1. Skype File URI Code Execution Vulnerability
|
|
2. Skype skype4com URI Handler Buffer Overflow
|
|
3. Skype URL Handling File Disclosure Vulnerability
|
|
4. Skype Multiple Buffer Overflow Vulnerabilities
|
|
5. Skype "callto:" URI Handler Buffer Overflow Vulnerability
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
