Vulnerability Note VU#668193

Skype VCARD handling routine contains a buffer overflow

Original Release date: 26 Oct 2005 | Last revised: 19 Dec 2005

Overview

A buffer overflow in the way Skype handles imported VCARDs may allow a remote attacker to execute code on a vulnerable system.

Description

Skype software provides telephone service over IP networks. Skype fails to properly validate imported VCARDs, allowing a buffer overflow to occur. The buffer overflow may stem from an input validation error in the Delphi routine SysUtils.WideFmtStr(...).

For more information, please see Skype Security Bulletin SKYPE-SB/2005-002 and Delphi Bug Report 4744.

Impact

A remote attacker may be able to execute arbitrary code if they can persuade a user to import a specially crafted VCARD with a Skype-specific URI with a vulnerable Skype installation.

Solution

Upgrade Skype

Please see Skype Security Bulletin SKYPE-SB/2005-002 for a list of fixed Skype versions.

Do not import VCARDs from untrusted sources


Exploitation occurs by importing a specially crafted VCARD. By only accessing a VCARDs from trusted or known sources, the chances of exploitation are reduced.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Skype TechnologiesAffected-26 Oct 2005
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported by SKY-CERT. SKY-CERT credits Mark Rowe of Pentest Limited with providing information regarding this issue.

This document was written by Jeff Gennari.

Other Information

  • CVE IDs: CVE-2005-3265
  • Date Public: 25 Oct 2005
  • Date First Published: 26 Oct 2005
  • Date Last Updated: 19 Dec 2005
  • Severity Metric: 10.13
  • Document Revision: 11

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.