Skype Technologies Skype Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	15190
Class:	Boundary Condition Error
CVE:	CVE-2005-3265
Remote:	Yes
Local:	No
Published:	Oct 25 2005 12:00AM
Updated:	Oct 25 2005 12:00AM
Credit:	Discovery credited to Mark Rowe of Pentest Limited.
Vulnerable:	Skype Technologies Skype 1.4 .0.83 Skype Technologies Skype 1.1 .0.0
Not Vulnerable:

Skype Technologies Skype Multiple Buffer Overflow Vulnerabilities

Skype is prone to multiple buffer overflow vulnerabilities. Successful exploitation of these issues could result in a denial of service or arbitrary code execution in the context of the user running the application.

These issues affect Skype for Windows releases 1.1.*.0 through 1.4.*.83.

Skype Technologies Skype Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Skype Technologies Skype Multiple Buffer Overflow Vulnerabilities

Solution:
This issue has been addressed in Skype for Windows 1.4.*.84 and later.


Skype Technologies Skype 1.1 .0.0

• Skype Technologies Skype 1.4.*.84
  http://www.skype.com/products/skype/windows/

Skype Technologies Skype 1.4 .0.83

• Skype Technologies Skype 1.4.*.84
  http://www.skype.com/products/skype/windows/

Skype Technologies Skype Multiple Buffer Overflow Vulnerabilities

References:

• Skype Homepage (Skype Technologies)
  
• SKYPE-SB/2005-002: Buffer overflow in Skype-specific URI and VCARD import handli (Skype Technologies)