Skype Software Vulnerabilities - 0 Day Exploitation 2011

Document Title:
===============
Skype Software Vulnerabilities - 0 Day Exploitation 2011


References:
===========
Document: https://www.vulnerability-lab.com/resources/documents/293.pdf
Speaker: https://conference.hitb.org/hitbsecconf2011kul/?page_id=1757

Conference Mirror:
https://conference.hitb.org/hitbsecconf2011kul/materials/D2T1 - SKYPE SOFTWARE VULNERABILITIES - ZERO DAY EXPLOITATION 2011.zip



Release Date:
=============
2011-10-17


Vulnerability Laboratory ID (VL-ID):
====================================
293


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Report


Severity Level:
===============
Critical


Technical Details & Description:
================================
SKYPE VOICE OVER IP - SOFTWARE VULNERABILITIES
TECHNIQUES & METHODS – ZERO DAY EXPLOITATION 2011
1. (Overview) Authors of the Skype Exploitation White-Paper
- 1.1 Pim J.F. Campers
- 1.2 Benjamin Kunz Mejri
2. (Preface) Information around the White-Paper & Skype
- 2.1 Infomercial
3. (Overview) Published Skype Vulnerabilities 2004-2010
- 3.1 URI Handler Skype Vulnerabilities
- 3.2 Denial of Service Skype Vulnerabilities
- 3.3 Creation & Deletion Skype Vulnerabilities
- 3.4 Buffer Overflow Skype Vulnerabilities
4. (How 2 Exploit & Detect?)
- 4.1 How to detect own Skype 0-day vulnerabilities?
- 4.2 How to exploit skype 0-day vulnerabilities out of the box?
- 4.2.1 Client Side Exploitation Map (Remote)
- 4.2.2 Server-Side 1 Exploitation Map (Remote & Local)
- 4.2.3 Server-Side 2 Exploitation Map (Remote & Local)
- 4.2.4 Pointer Exploitation Map (Local)
- 4.2.5 Exchange Buffer Overflow Map (Remote & Local)
- 4.2.7 Denial of Service Map (Local to Remote)
5.(Main Presentation) Presentation of own 0 day Skype Vulnerabilities
- 5.6 Skype v5.3.x v2.2.x v5.2.x – Denial of Service Vulnerability
- 5.2 Skype 5.3.x 2.2.x 5.2.x - Persistent Software Vulnerability
- 5.1 Skype 5.3.x 2.2.x 5.2.x - Persistent Profile XSS Vulnerability
- 5.5 Skype v5.2.x and v5.3.x – Memory Corruption Vulnerability
- 5.3 Skype v5.3.x - Transfer Standby Buffer Overflow Vulnerability
6. Skype Security & Time-Lines
- 6.1 Response, Fix/Patch > Time-Line
7. (Review) Security Session Videos
- 6.1 Skype (VoIP) - Denial of Service Vulnerability.wmv [HD]
- 6.2 Skype (VoIP) - Persistent Profile XSS Vulnerability [HD]
- 6.3 Skype (VoIP) - [Pointer Bug] Memory Corruption [HD]
8. Credits & Infomercial
- 8.1 Vulnerability Laboratory


Credits & Authors:
==================
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve) &  Pim J.F. Campers (X4lt)


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory