An update has been released for Skype, which implements security enhancements to prevent compromise of users' systems.

Skype uses the Internet Explorer web control to render HTML from certain websites (e.g. DailyMotion, Metacafe, and SkypeFind). As the content is rendered in the "Local Machine" security zone, this allows execution of arbitrary script code on a user's system via script insertion vulnerabilities present in these websites.

Various vulnerabilities have been discovered in these sites, which provide vectors when a user e.g. uses the Skype video gallery browser section or finds a video uploaded to the DailyMotion gallery with a specially crafted video title.

Successful exploitation requires that a displayed website is vulnerable to script insertion.

The vulnerability is reported in the following Skype for Windows versions:
- All versions including 3.5.*
- Version 3.6.*.244 and prior

Solution
Update or upgrade to version 3.6.*.248 or later, which now runs the Internet Explorer web control in the "Internet" security zone.
Further details available to Secunia VIM customers

Provided and/or discovered by
Aviv Raff

Changelog
Further details available to Secunia VIM customers

Original Advisory
Skype:
http://www.skype.com/security/skype-sb-2008-001-update2.html
http://www.skype.com/intl/en/security/skype-sb-2008-002.html
http://www.skype.com/intl/en/security/skype-sb-2008-001-update1.html
http://www.skype.com/intl/en/security/skype-sb-2008-001.html

Aviv Raff:
http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx
http://aviv.raffon.net/2008/01/31/AttackersCanSkypeFindYou.aspx

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers