Feeds

Scramble to fix Skype security bug

Hanging on the telephone

Remote control for virtualized desktops

Security researchers have identified two groups of potentially serious security vulnerabilities involving Skype, the popular VoIP client software. Both create a means for hackers to run hostile code on systems running vulnerable versions of Skype. Skype has issued patches for the "critical" security bugs.

In the first case, a security bug in the Skype for Windows means the software can be crashed and forced to execute arbitrary code through a buffer overflow when presented with malformed URLs in the Skype-specific URI format callto:// and skype://. Skype can also be made to execute arbitrary code via the importation of a maliciously formated VCARD (an electronic business card format).

A second security vulnerability is not restricted to Windows PCs and hits Skype across all supported platforms. Here a heap-based buffer overflow security is the culprit but the upshot is the same as the Windows specific bug - hackers might be able to take over vulnerable systems, at least in theory. At the time of writing, neither of the security bugs is subject to either publicly available exploits or malicious code. Nonetheless users are urged to upgrade to Skype for Windows release 1.4.*.84, Skype for Mac OS X 1.3.*.17 or Skype for Linux 1.2.*.18 or later to guard against attack. No patch for Skype for Pocket PC has been released.

The vulnerabilities were discovered by Pentest and EADS Corporate Research Center. A bulletin from Secunia provides links to relevant advisories and patches. Advisories from Skype can be found here and here.

The scope - and cross-platform reach - of the vulnerabilities has security researchers worried. "Skype's ubiquity and the closed nature of their protocol means that all clients are based on the same code – Windows, Linux, business and home users all share the same, equally vulnerable client, a fecund breeding ground for worms and other malicious code," said Tom Newton, product manager for firewall vendor SmoothWall. "Skype's ease of use is partially facilitated by the port-agile firewall-dodging protocol used – this poses further danger to unsuspecting administrators who may not realise the scope of VoIP activity on their network."

In a statement, Skype said it reacted swiftly to reports of security vulnerabilities in its communications software with the release of software updates. "The updates were needed in order to fix two software problems, one of which can render a user vulnerable to a malicious attack if the user is duped into following web hyperlinks that are specially crafted to cause unwanted software to run."

"Skype proactively discloses and rates security issues when they arise so that its customers have the latest information about its software. In addition, Skype participates as a member in the international Forum of Incident Response and Security Teams, a global body that allows for rapid interchange of information among software vendors, government, business and network operators," it added. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.