Overview
A buffer overflow in Skype may allow a remote attacker to execute code on a vulnerable system.
Description
Skype software provides telephone service over IP networks. There is a buffer overflow in the routines that handle Skype-specific URIs (callto:// or skype://). The buffer overflow may stem from an input validation error in the Delphi routine SysUtils.WideFmtStr(...). For more information, please see Skype Security Bulletin SKYPE-SB/2005-002 and Delphi Bug Report 4744. |
Impact
A remote attacker may be able to execute arbitrary code if they can persuade a user to access a Skype-specific URI with a vulnerable Skype installation. |
Solution
Upgrade Skype |
Do not access Skype URIs from untrusted sources
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | N/A | N/A |
| Temporal | N/A | N/A |
| Environmental | N/A |
References
Acknowledgements
This vulnerability was reported by SKY-CERT. SKY-CERT credits Mark Rowe of Pentest Limited with providing information regarding this issue.
This document was written by Jeff Gennari.
Other Information
| CVE IDs: | CVE-2005-3265 |
| Severity Metric: | 10.13 |
| Date Public: | 2005-10-25 |
| Date First Published: | 2005-10-26 |
| Date Last Updated: | 2005-10-26 16:49 UTC |
| Document Revision: | 14 |