That terrifying 'unfixable' Microsoft Skype security flaw: THE TRUTH

Oh yeah, we patched that in October, Windows giant yawns

By Shaun Nichols in San Francisco


Microsoft has poured a bucket of cold water on people freaking out over a supposedly unfixable security flaw in Skype.

The infosec world was atwitter this week over fears and headlines of a nasty bug in Redmond's video chat app that apparently cannot be addressed without a massive code rewrite. That the programming blunder was so major, it cannot be simply patched, and Microsoft will have no option but to reengineer Skype for Windows and issue a new release sometime in the future.

Well, it was fixed in October.

Far be it from us to run to Microsoft's rescue, but the vulnerability is present in Skype for Windows versions 7.40 and lower. In October 2017, Microsoft released version 8 without the flaw, so if you kept up to date, you're fine. If you're running version 7, get version 8.

The security cockup allows malware running on a Windows PC to exploit Skype's update mechanism to gain full control over the computer via DLL hijacking. Exploiting the design oversight will grant malicious software, or anyone logged into the box, full system-level privileges. The update tool uses temporary files stored in the %SYSTEMROOT% directory, and it's possible to drop custom DLLs into that folder and have them injected into an installer process that runs with system-level privileges.

So, yeah, install version 8 if you haven't already. Yes, Microsoft doesn't offer it automatically to all users, and that sucks, but at least now you know what to do.

"There was an issue with an older version of the Skype for Windows desktop installer – version 7.40 and lower. The issue was in the program that installs the Skype software – the issue was not in the Skype software itself," Skype program manager Ellen Kilbourne said in a support forum post on Wednesday.

"Customers who have already installed this version of Skype for Windows desktop are not affected. We have removed this older version of Skype for Windows desktop from our website"

Roses are red, Windows error screens are blue. It's 2018, and an email can still pwn you


The issue was discovered by German researcher Stefan Kanthak, who said he alerted Redmond in September. Kanthak said he was told in October that patching the bug in the software would require a "large code revision," and disclosed details of the flaw this month to warn everyone of the problem.

That revelation sparked a lot of handwringing and speculation the bug would be a "major" ongoing security issue that would prove highly difficult and expensive for Microsoft to address, leaving punters vulnerable for months to escalation-of-privilege attacks via local users and applications.

Microsoft, however, confirmed this week it addressed the coding cockup back in October, and that the vulnerability can be killed off by simply updating Skype. Those running the latest version have been protected for the past few months. We're also not aware of any malware exploiting this security hole.

This will provide a bit of relief to IT administrators who just two days ago were served a massive Patch Tuesday update that addressed 50 CVE-listed vulnerabilities in Redmond's products, and faced the possibility of having to test and deploy an out-of-band patch for Skype, too. ®

Sign up to our NewsletterGet IT in your inbox daily


More from The Register

Microsoft takes a pruning axe to Skype's forest of features

Say farewell to Highlights ... if you even noticed it was there

Using Microsoft's Dynamics 365 Finance and Operations? Using Skype? Not for long!

Upcoming update could bork on-prem logins, warns Redmond

Skype-on-Linux graduates from Alpha to Beta status

Decent effort, but it is hard to see why Redmond is bothering

Skype Classic headed for the chopping block on September 1

You will learn to love version 8, whether you like it or not

Microsoft gets ready to kill Skype Classic once again: 'This time we mean it'

Remember remember the first of November

Skype can now record your 'special moments' in front of the computer

Except that one. Nobody wants that kept for posterity

Guys, you need to sit down and have a chat: Skype rolls out SMS a week after Microsoft

Updated Skype also does MMS. Your Phone also does photos. Neither talks to iOS

Hackers uncork experimental Linux-targeting malware

SSH... it's Shishiga

New Skype for Linux Alpha

Still using Skype? Good news! After HOURS of meetings, Microsoft reckons it knows when you're Not Active

Plus: New passive aggressive 'Quiet Mode'