Skype for Mac contains a format string error in the handling of URI arguments

Overview

Skype for Mac contains a format string vulnerability in the handling of URIs, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

Skype software provides telephone service over IP networks. There is a format string vulnerability in the NSRunAlertPanel function in the routines that handle Skype-specific URIs, such as skype://.

---

Impact

By sending a specially crafted URI to Skype, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the user. Such a URI can be sent to Skype by convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment). The attacker could also cause Skype to crash.

---

Solution

Apply an update

This vulnerability is addressed in Skype for Mac release 1.5.*.80 or later.

---

Vendor Information

202604

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Skype Technologies __ Affected

Updated: October 06, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see SKYPE-SB/2006-002.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23202604 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.skype.com/security/skype-sb-2006-002.html&gt;
• <http://www.security-protocols.com/sp-x34-advisory.php&gt;
• <http://secunia.com/advisories/22185/&gt;

Acknowledgements

This vulnerability was reported by Tom Ferris of Security-Protocols.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2006-5084
Severity Metric:	8.29 Date Public: