Feeds

Scramble to fix Skype security bug

Hanging on the telephone

The essential guide to IT transformation

Security researchers have identified two groups of potentially serious security vulnerabilities involving Skype, the popular VoIP client software. Both create a means for hackers to run hostile code on systems running vulnerable versions of Skype. Skype has issued patches for the "critical" security bugs.

In the first case, a security bug in the Skype for Windows means the software can be crashed and forced to execute arbitrary code through a buffer overflow when presented with malformed URLs in the Skype-specific URI format callto:// and skype://. Skype can also be made to execute arbitrary code via the importation of a maliciously formated VCARD (an electronic business card format).

A second security vulnerability is not restricted to Windows PCs and hits Skype across all supported platforms. Here a heap-based buffer overflow security is the culprit but the upshot is the same as the Windows specific bug - hackers might be able to take over vulnerable systems, at least in theory. At the time of writing, neither of the security bugs is subject to either publicly available exploits or malicious code. Nonetheless users are urged to upgrade to Skype for Windows release 1.4.*.84, Skype for Mac OS X 1.3.*.17 or Skype for Linux 1.2.*.18 or later to guard against attack. No patch for Skype for Pocket PC has been released.

The vulnerabilities were discovered by Pentest and EADS Corporate Research Center. A bulletin from Secunia provides links to relevant advisories and patches. Advisories from Skype can be found here and here.

The scope - and cross-platform reach - of the vulnerabilities has security researchers worried. "Skype's ubiquity and the closed nature of their protocol means that all clients are based on the same code – Windows, Linux, business and home users all share the same, equally vulnerable client, a fecund breeding ground for worms and other malicious code," said Tom Newton, product manager for firewall vendor SmoothWall. "Skype's ease of use is partially facilitated by the port-agile firewall-dodging protocol used – this poses further danger to unsuspecting administrators who may not realise the scope of VoIP activity on their network."

In a statement, Skype said it reacted swiftly to reports of security vulnerabilities in its communications software with the release of software updates. "The updates were needed in order to fix two software problems, one of which can render a user vulnerable to a malicious attack if the user is duped into following web hyperlinks that are specially crafted to cause unwanted software to run."

"Skype proactively discloses and rates security issues when they arise so that its customers have the latest information about its software. In addition, Skype participates as a member in the international Forum of Incident Response and Security Teams, a global body that allows for rapid interchange of information among software vendors, government, business and network operators," it added. ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?