__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN SkypeFind Vulnerability [US-CERT Vulnerability Note VU#794236] February 14, 2008 22:00 GMT Number S-185 ______________________________________________________________________________ PROBLEM: The Skype client does not properly filter user-supplied input that was received from the SkypeFind service. This vulnerability may allow an attacker to execute arbitrary code. PLATFORM: SkypeFind DAMAGE: Execute arbitrary code. SOLUTION: Skype has addressed this issue by filtering input supplied to the SkypeFind service. Restrict access to the Skype URI Blocking the skype: URI handler by using proxy servers or application firewalls may prevent some remote vulnerabilities in Skype from being exploited without user interaction. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. The user-supplied script runs in the Local ASSESSMENT: Machine Zone a remote unauthenticated attacker may be able to exexute arbitrary code. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/s-185.shtml ORIGINAL BULLETIN: http://www.kb.cert.org/vuls/id/794236 ADDITIONAL LINK: http://www.kb.cert.org/vuls/id/248184 CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2008-0583 ______________________________________________________________________________ [***** Start US-CERT Vulnerability Note VU#794236 *****] Vulnerability Note VU#794236 SkypeFind fails to properly sanitize user-supplied input Overview The Skype client does not properly filter user-supplied input that was received from the SkypeFind service. This vulnerability may allow an attacker to execute arbitrary code. I. Description Skype is a peer-to-peer application that provides Voice over IP (VoIP) and Instant Messaging services. The Skype client is available for the Microsoft Windows, Apple OS X and Linux operating systems. SkypeFind allows users to review businesses. These reviews are viewable by others. Skype does not properly filter input that was supplied to the SkypeFind full name field. An attacker may be able to exploit this vulnerability by injecting script into the full name field. When a user viewed the specially crafted SkypeFind profile, the script would be run in the Internet Explorer Local Machine Zone. II. Impact As explained in VU#248184, since the user-supplied script runs in the Local Machine Zone a remote unauthenticated attacker may be able to execute arbitrary code. III. Solution Skype has addressed this issue by filtering input supplied to the SkypeFind service. Restrict access to the Skype URI Blocking the skype: URI handler by using proxy servers or application firewalls may prevent some remote vulnerabilities in Skype from being exploited without user interaction. Systems Affected Vendor Status Date Updated Skype Technologies Vulnerable 6-Feb-2008 References http://aviv.raffon.net/2008/01/31/AttackersCanSkypeFindYou.aspx http://msdn2.microsoft.com/en-us/library/ms537183.aspx#local http://www.skype.com/help/guides/skypefind.html http://www.kb.cert.org/vuls/id/248184 Credit This vulnerability was made public by Aviv Raff. This document was written by Ryan Giobbi. Other Information Date Public 01/31/2008 Date First Published 02/13/2008 11:03:33 AM Date Last Updated 02/13/2008 CERT Advisory CVE Name CVE-2008-0582; CVE-2008-0583 US-CERT Technical Alerts Metric 0.00 Document Revision 38 [***** End US-CERT Vulnerability Note VU#794236 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of US-CERT for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) S-175: Vulnerability in Microsoft Word S-176: Cumulative Security Update for Internet Explorer S-177: Vulnerabilities in Microsoft Works File Converter S-178: Vulnerabilities in Microsoft Office Publisher S-179: Vulnerability in Microsoft Office S-180: Adobe Reader and Acrobat Vulnerabilities S-181: Mac OS X v10.5 / Security Update 2008-001 S-182: Vulnerability in Active Directory S-183: Vulnerability in Internet Information Services S-184: Cisco Unified IP Phone Vulnerabilities