( , ) (,
. `.' ) ('. ',
). , ('. ( ) (
(_,) .`), ) _ _,
/ _____/ / _ \ ____ ____ _____
\____ \==/ /_\ \ _/ ___\/ _ \ / \
/ \/ | \\ \__( <_> ) Y Y \
/______ /\___|__ / \___ >____/|__|_| /
\/ \/.-. \/ \/:wq
(x.0)
'=.|w|.='
_='`"``=. presents.. Skype URI Handler Input Validation
Versions affected: All versions prior to 4.2.0.1.55 (v4.2 hotfix #1)
+-----------+
|Description|
+-----------+The Windows Skype client implements two URI handlers, Skype: and Skype-Plugin. Both handlers allow for easy browser integration and are supported by all
modern browsers. When a Skype link is clicked, the Skype.exe process is spawned with the "/URI:%1" command argument, followed by the user specified
phone number or contact name. For example, clicking the link:
Skype:PaulCraig will spawn the process Skype.exe “/URI:Skype:PaulCraig“ Due to a flaw in the current user input validation performed by Skype, it is possible to append additional command line arguments which are subsequently
processed during the launch of Skype.exe. In 2006 colleague Brett Moore, discovered a similar vulnerability in Skype which led to certain security restrictions being enforced when using the
Skype: URI handler. Brett’s exploit at the time involved including additional command line arguments to the Skype.exe process which would send a file to a
remote user when a Skype link was clicked. Changes were made to Skype to remove available command line arguments when the /URI argument is present, and to resolve the discovered injection vulnerability. Although many of the useful arguments have been disallowed, Security-Assessment.com found that the /Datapath argument can be included and directed to a remote SMB share directly through a specially crafted Skype URI. The Datapath argument specifies the location of the Skype configuration files and security policy. Specifying a Datapath argument will override any local security policy defined in the Windows registry. A remote user is capable of crafting a link that when clicked, will spawn Skype.exe on a client using a Datapath location which is present on a remote
SMB share. The Skype client will load any configuration or security policy present, and save the users Skype account information to the remote share. This allows a remote user to control the Skype configuration and security policy of the local client instance of Skype. Settings such as a remote
proxy can be defined, which could be used to Man in The Middle Skype communications.Read more: Bugtraq
. `.' ) ('. ',
). , ('. ( ) (
(_,) .`), ) _ _,
/ _____/ / _ \ ____ ____ _____
\____ \==/ /_\ \ _/ ___\/ _ \ / \
/ \/ | \\ \__( <_> ) Y Y \
/______ /\___|__ / \___ >____/|__|_| /
\/ \/.-. \/ \/:wq
(x.0)
'=.|w|.='
_='`"``=. presents.. Skype URI Handler Input Validation
Versions affected: All versions prior to 4.2.0.1.55 (v4.2 hotfix #1)
+-----------+
|Description|
+-----------+The Windows Skype client implements two URI handlers, Skype: and Skype-Plugin. Both handlers allow for easy browser integration and are supported by all
modern browsers. When a Skype link is clicked, the Skype.exe process is spawned with the "/URI:%1" command argument, followed by the user specified
phone number or contact name. For example, clicking the link:
Skype:PaulCraig will spawn the process Skype.exe “/URI:Skype:PaulCraig“ Due to a flaw in the current user input validation performed by Skype, it is possible to append additional command line arguments which are subsequently
processed during the launch of Skype.exe. In 2006 colleague Brett Moore, discovered a similar vulnerability in Skype which led to certain security restrictions being enforced when using the
Skype: URI handler. Brett’s exploit at the time involved including additional command line arguments to the Skype.exe process which would send a file to a
remote user when a Skype link was clicked. Changes were made to Skype to remove available command line arguments when the /URI argument is present, and to resolve the discovered injection vulnerability. Although many of the useful arguments have been disallowed, Security-Assessment.com found that the /Datapath argument can be included and directed to a remote SMB share directly through a specially crafted Skype URI. The Datapath argument specifies the location of the Skype configuration files and security policy. Specifying a Datapath argument will override any local security policy defined in the Windows registry. A remote user is capable of crafting a link that when clicked, will spawn Skype.exe on a client using a Datapath location which is present on a remote
SMB share. The Skype client will load any configuration or security policy present, and save the users Skype account information to the remote share. This allows a remote user to control the Skype configuration and security policy of the local client instance of Skype. Settings such as a remote
proxy can be defined, which could be used to Man in The Middle Skype communications.Read more: Bugtraq