[ISN] Scramble to fix Skype security bug

[InfoSec News]

http://www.theregister.co.uk/2005/10/25/skype_vuln/

By John Leyden
25th October 2005 

Security researchers have identified two groups of potentially serious
security vulnerabilities involving Skype, the popular VoIP client
software. Both create a means for hackers to run hostile code on
systems running vulnerable versions of Skype. Skype has issued patches
for the "critical" security bugs.

In the first case, a security bug in the Skype for Windows means the
software can be crashed and forced to execute arbitrary code through a
buffer overflow when presented with malformed URLs in the
Skype-specific URI format callto:// and skype://. Skype can also be
made to execute arbitrary code via the importation of a maliciously
formated VCARD (an electronic business card format).

A second security vulnerability is not restricted to Windows PCs and
hits Skype across all supported platforms. Here a heap-based buffer
overflow security is the culprit but the upshot is the same as the
Windows specific bug - hackers might be able to take over vulnerable
systems, at least in theory. At the time of writing, neither of the
security bugs is subject to either publicly available exploits or
malicious code. Nonetheless users are urged to upgrade to Skype for
Windows release 1.4.*.84, Skype for Mac OS X 1.3.*.17 or Skype for
Linux 1.2.*.18 or later to guard against attack. No patch for Skype
for Pocket PC has been released.

The vulnerabilities were discovered by Pentest and EADS Corporate
Research Center. A bulletin from Secunia [1] provides links to
relevant advisories and patches. Advisories from Skype can be found
here [2] and here [3].

The scope - and cross-platform reach - of the vulnerabilities has
security researchers worried. "Skype's ubiquity and the closed nature
of their protocol means that all clients are based on the same code .  
Windows, Linux, business and home users all share the same, equally
vulnerable client, a fecund breeding ground for worms and other
malicious code," said Tom Newton, product manager for firewall vendor
SmoothWall. "Skype's ease of use is partially facilitated by the
port-agile firewall-dodging protocol used . this poses further danger
to unsuspecting administrators who may not realise the scope of VoIP
activity on their network."

No-one from Skype was available for comment at the time of going to
press. ®

[1] http://secunia.com/advisories/17305/
[2] http://www.skype.com/security/skype-sb-2005-02.html
[3] http://www.skype.com/security/skype-sb-2005-03.html