Skype Technologies Skype CallTo URI Handler Buffer Overrun Vulnerability

Bugtraq ID:	10513
Class:	Boundary Condition Error
CVE:	CVE-2004-1777
Remote:	Yes
Local:	No
Published:	Jun 10 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	Discovery of this vulnerability is credited to Hillel Himovich <[email protected]>.
Vulnerable:	Skype Technologies Skype 0.98.0.04
Not Vulnerable:

Skype Technologies Skype CallTo URI Handler Buffer Overrun Vulnerability

Skype is reported to be prone to a buffer overrun vulnerability.

The vulnerability is reported to occur due to a lack of bounds checking performed on "callto://" URI data, when a callto URI is followed.

This may result in the corruption of sensitive regions of memory. Ultimately, it is conjectured that this issue may be exploited to execute arbitrary code in the context of a user who follows a malicious URI.

Skype Technologies Skype CallTo URI Handler Buffer Overrun Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Skype Technologies Skype CallTo URI Handler Buffer Overrun Vulnerability

Solution:
The vendor has released an update to address this issue:


Skype Technologies Skype 0.98.0.04

• Skype Technologies Skype 0.98.0.28
  http://www.skype.com/download.html

Skype Technologies Skype CallTo URI Handler Buffer Overrun Vulnerability

References:

• Skype Homepage (Skype Technologies)
  
• Skype URI callto username overflow (Hillel Himovich )