Feeds

Scramble to fix Skype security bug

Hanging on the telephone

Intelligent flash storage arrays

Security researchers have identified two groups of potentially serious security vulnerabilities involving Skype, the popular VoIP client software. Both create a means for hackers to run hostile code on systems running vulnerable versions of Skype. Skype has issued patches for the "critical" security bugs.

In the first case, a security bug in the Skype for Windows means the software can be crashed and forced to execute arbitrary code through a buffer overflow when presented with malformed URLs in the Skype-specific URI format callto:// and skype://. Skype can also be made to execute arbitrary code via the importation of a maliciously formated VCARD (an electronic business card format).

A second security vulnerability is not restricted to Windows PCs and hits Skype across all supported platforms. Here a heap-based buffer overflow security is the culprit but the upshot is the same as the Windows specific bug - hackers might be able to take over vulnerable systems, at least in theory. At the time of writing, neither of the security bugs is subject to either publicly available exploits or malicious code. Nonetheless users are urged to upgrade to Skype for Windows release 1.4.*.84, Skype for Mac OS X 1.3.*.17 or Skype for Linux 1.2.*.18 or later to guard against attack. No patch for Skype for Pocket PC has been released.

The vulnerabilities were discovered by Pentest and EADS Corporate Research Center. A bulletin from Secunia provides links to relevant advisories and patches. Advisories from Skype can be found here and here.

The scope - and cross-platform reach - of the vulnerabilities has security researchers worried. "Skype's ubiquity and the closed nature of their protocol means that all clients are based on the same code – Windows, Linux, business and home users all share the same, equally vulnerable client, a fecund breeding ground for worms and other malicious code," said Tom Newton, product manager for firewall vendor SmoothWall. "Skype's ease of use is partially facilitated by the port-agile firewall-dodging protocol used – this poses further danger to unsuspecting administrators who may not realise the scope of VoIP activity on their network."

In a statement, Skype said it reacted swiftly to reports of security vulnerabilities in its communications software with the release of software updates. "The updates were needed in order to fix two software problems, one of which can render a user vulnerable to a malicious attack if the user is duped into following web hyperlinks that are specially crafted to cause unwanted software to run."

"Skype proactively discloses and rates security issues when they arise so that its customers have the latest information about its software. In addition, Skype participates as a member in the international Forum of Incident Response and Security Teams, a global body that allows for rapid interchange of information among software vendors, government, business and network operators," it added. ®

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.