Skype Facebook Plugin Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	48950
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 01 2011 12:00AM
Updated:	Aug 01 2011 12:00AM
Credit:	secalert.net
Vulnerable:	Skype Technologies Skype 5.4 Skype Technologies Skype 5.3 Skype Technologies Skype 5.0.0.105
Not Vulnerable:	Skype Technologies Skype 5.5

Skype Facebook Plugin Multiple Cross Site Scripting Vulnerabilities

Skype Facebook plugin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Skype 5.5 are vulnerable.

Skype Facebook Plugin Multiple Cross Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.

The following video demonstrates this issue:

http://www.youtube.com/watch?v=IrOyCEdqBOg&feature=player_embedded

Skype Facebook Plugin Multiple Cross Site Scripting Vulnerabilities

Solution:
Vendor updates are available. Please contact the vendor for more information.

Skype Facebook Plugin Multiple Cross Site Scripting Vulnerabilities

References:

• Skype Client - Remote Session hijacking over Facebook-Integration (Skype )
  
• Skype Homepage (Skype Technologies)
  
• Skype Update 5.5 with Critical Security Vulnerability (Skype)