Feeds

Scramble to fix Skype security bug

Hanging on the telephone

New hybrid storage solutions

Security researchers have identified two groups of potentially serious security vulnerabilities involving Skype, the popular VoIP client software. Both create a means for hackers to run hostile code on systems running vulnerable versions of Skype. Skype has issued patches for the "critical" security bugs.

In the first case, a security bug in the Skype for Windows means the software can be crashed and forced to execute arbitrary code through a buffer overflow when presented with malformed URLs in the Skype-specific URI format callto:// and skype://. Skype can also be made to execute arbitrary code via the importation of a maliciously formated VCARD (an electronic business card format).

A second security vulnerability is not restricted to Windows PCs and hits Skype across all supported platforms. Here a heap-based buffer overflow security is the culprit but the upshot is the same as the Windows specific bug - hackers might be able to take over vulnerable systems, at least in theory. At the time of writing, neither of the security bugs is subject to either publicly available exploits or malicious code. Nonetheless users are urged to upgrade to Skype for Windows release 1.4.*.84, Skype for Mac OS X 1.3.*.17 or Skype for Linux 1.2.*.18 or later to guard against attack. No patch for Skype for Pocket PC has been released.

The vulnerabilities were discovered by Pentest and EADS Corporate Research Center. A bulletin from Secunia provides links to relevant advisories and patches. Advisories from Skype can be found here and here.

The scope - and cross-platform reach - of the vulnerabilities has security researchers worried. "Skype's ubiquity and the closed nature of their protocol means that all clients are based on the same code – Windows, Linux, business and home users all share the same, equally vulnerable client, a fecund breeding ground for worms and other malicious code," said Tom Newton, product manager for firewall vendor SmoothWall. "Skype's ease of use is partially facilitated by the port-agile firewall-dodging protocol used – this poses further danger to unsuspecting administrators who may not realise the scope of VoIP activity on their network."

In a statement, Skype said it reacted swiftly to reports of security vulnerabilities in its communications software with the release of software updates. "The updates were needed in order to fix two software problems, one of which can render a user vulnerable to a malicious attack if the user is duped into following web hyperlinks that are specially crafted to cause unwanted software to run."

"Skype proactively discloses and rates security issues when they arise so that its customers have the latest information about its software. In addition, Skype participates as a member in the international Forum of Incident Response and Security Teams, a global body that allows for rapid interchange of information among software vendors, government, business and network operators," it added. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Enigmail PGP plugin forgets to encrypt mail sent as blind copies
User now 'waiting for the bad guys come and get me with their water-boards'
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.