Microsoft Skype v8.34 Android - Authentication Bypass

Document Title:
===============
Microsoft Skype v8.34 Android - Authentication Bypass


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2177

MSRC Bulletin: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0622

Video: https://www.vulnerability-lab.com/get_content.php?id=2178


Public Press:
https://www.golem.de/news/sicherheitsluecke-mit-skype-android-pin-umgehen-1901-138551.html
https://www.chip.de/news/Android-User-sollten-App-pruefen-Skype-Sicherheitsluecke-setzt-PIN-Code-ausser-Kraft_157218623.html
https://www.netzwelt.de/news/168997-skype-schwachstelle-erlaubte-umgehen-smartphone-sperre.html
https://www.techbook.de/apps/sicherheitsluecke-wie-ein-skype-anruf-die-smartphone-pin-umgeht

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-0622

CVE-ID:
=======
CVE-2019-0622


Release Date:
=============
2019-01-10


Vulnerability Laboratory ID (VL-ID):
====================================
2177


Common Vulnerability Scoring System:
====================================
6.3


Vulnerability Class:
====================
Authentication Bypass


Current Estimated Price:
========================
5.000€ - 10.000€


Product & Service Introduction:
===============================
Skype keeps the world talking. Say “hello” with an instant message, voice or video call – all for free, no matter what 
device they use Skype on. Skype is available on phones, tablets, PCs, and Macs.

(Copy of the Homepage: https://play.google.com/store/apps/details?id=com.skype.raider&hl=en )



Abstract Advisory Information:
==============================
The vulnerability laboratory core team researcher discovered a local authentication bypass vulnerability in the official Microsoft Skype android software client.


Vulnerability Disclosure Timeline:
==================================
2018-12-10: Researcher Notification & Coordination (Security Researcher)
2018-12-11: Vendor Notification (Microsoft Security Department - MSRC)
2018-12-13: Vendor Response/Feedback (Microsoft Security Department - MSRC)
2018-12-23: Vendor Fix/Patch (Microsoft Service Developer Team)
2018-01-08: Security Acknowledgements (Microsoft Security Department - MSRC)
2018-01-08: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Local


Severity Level:
===============
Medium


Authentication Type:
====================
Pre Auth (No Privileges or Session)


User Interaction:
=================
No User Interaction


Disclosure Type:
================
Independent Security Research


Technical Details & Description:
================================
An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests.
An attacker who successfully exploited this vulnerability could bypass Android's lockscreen and access a victim's personal information.
To exploit the vulnerability, an attacker would need have physical access to the phone.The security update addresses the 
vulnerability by correcting how Skype for Android handles authentication requests.


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by local attackers without user interaction. For security demonstration or to reproduce the 
vulnerability follow the provided information and steps below to continue.


Note: The following video demonstrates the proof of concept used for microsoft (msrc) to reproduce and identify the issue.
The video has been produced and recorded by florain kunushevci a researchers of the public 67vulnerability labs community.


Solution - Fix & Patch:
=======================
2018-12-23: Vendor Fix/Patch (Microsoft Service Developer Team)


Security Risk:
==============
The security risk of the local authentication bypass vulnerability in the android software client of skype is estimated as high.


Credits & Authors:
==================
Florian Kunushevci [[email protected]] - https://www.vulnerability-lab.com/show.php?user=Florian+Kunushevci


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab 
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits 
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do 
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. 
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com		www.vuln-lab.com				www.vulnerability-db.com
Services:   magazine.vulnerability-lab.com	paste.vulnerability-db.com 			infosec.vulnerability-db.com
Social:	    twitter.com/vuln_lab		facebook.com/VulnerabilityLab 			youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	vulnerability-lab.com/rss/rss_upcoming.php 	vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	vulnerability-lab.com/register.php  vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other 
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or 
edit our material contact (admin@ or research@) to get a ask permission.

				    Copyright © 2018 | Vulnerability Laboratory - [Evolution Security GmbH]™