Document Title: =============== Skype 5.8x 5.5x - Corruption & Persistent Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=455 MRSC ID: 12250 Video: http://vulnerability-lab.com/get_content.php?id=457 Release Date: ============= 2012-03-27 Vulnerability Laboratory ID (VL-ID): ==================================== 455 Common Vulnerability Scoring System: ==================================== 6.1 Product & Service Introduction: =============================== Skype is a software application that allows users to make voice and video calls and chats over the Internet. Calls to other users within the Skype service are free, while calls to both traditional landline telephones and mobile phones can be made for a fee using a debit-based user account system. Skype has also become popular for its additional features which include instant messaging, file transfer, and video conferencing. Skype has 663 million registered users as of 2010. The network is operated by Skype Limited, which has its headquarters in Luxembourg. Most of the development team and 44% of the overall employees of Skype are situated in the offices of Tallinn and Tartu, Estonia. (Copy of the Homepage: http://en.wikipedia.org/wiki/Skype ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered a pointer corruptio issue in the Skype v5.8.x, v2.2 and v5.5.2340 software client. Vulnerability Disclosure Timeline: ================================== 2012-02-24: Vendor Notification 2012-02-25: Vendor Response/Feedback 2012-03-20: Vendor Fix/Patch 2012-03-29: Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Microsoft Corp. Product: Skype - Windows, MacOs & Linux 5.8.0.156, 5.5.0.2340, 2.2 Beta Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A pointer corruption vulnerability has been discovered in the official skype for windows v5.6.59.10 and macos v5.5.2340 client software. The vulnerability allows an attacker to crash the software core process with an unhandled skype software pointer exception bug. The bug is located in the software charset configuration. Attackers are able to perform requests with special crafted formats to compromise the skype process and communication channel. The vulnerability allows an attacker to freeze, block, crash or glitch the communication messagebox of the connected conference persons. The special crafted symbole format link can also be implemented to the software input fields which results in different other unhandled client errors. Remote attackers are able to implement the symbole strings to the contact user request messagebox or message topic. The result is also a stable persistent error message and a denial of service. Attackers can also implement the test poc to the group labelname which results in a stable group error with different exceptions as well. The facebook integration allows to sync the account with skype and can also redisplay the issue with the error via facebook module and as wall posting. The callto function allows an attacker to implement the issue persistent on a victim user profile by using the symbole string as nickname. Vulnerable Module(s): [+] MessageBox & Request Contact [+] Contact Request Messagebox - Add Skype User [+] Group Topic & Group Information Name [+] Facebook integration - Connect Account Wall Postings Affected OS version(s): [+] Windows v5.8.0.156, MacOS 5.5.0.2340 & Linux 2.2 Beta Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers without required user inter action and with low privileged skype user account. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. PoC: Message Context Skype ็¬็ส็็็็็ -็็็็็็็็็็็็็็็็็็็็ส็¬็็ ็็็็็็¬็็็็็็็็็็็็็็็็ส็ ็็็¬็็็็็็็็็-็็็็็็็ ็็็็็ส็็็็็็็¬็็็็็็็็็็¬็ ็็็็็็็ส็็็็็็็็็็¬็็็็็็็็็็็ ¬็็็็ส็็็็็็็็็็็็็¬็็็็ ็็็็็็็็¬ส็็็็็็็็็็็็็็็็-็็็็็็็็็ส็็็็็็็็็็็็็็็ ็็็็ ¬็็็็็็ส็็็็็็็¬ส็็็็็็็็็็ ็็็็็็็็็็็็็็็ส็็็¬¬็็็็็็ ็็็็็็็็็็็็็็็็ส็็็็็็¬็ PoC: Call to Link Skype Skype Me™! ?call">Skype Me™! Solution - Fix & Patch: ======================= Update the skype software client to the version 2.3 (linux) and 5.8.0.158 (windows) to fix the vulnerability. Security Risk: ============== The security risk of the pointer corruption software vulnerability in the skype software is estimated as high. (CVSS 6.1) Credits & Authors: ================== Vulnerability Laboratory - Benjamin Kunz Mejri , Alexander Fuchs & Ucha Gobejishvili Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory