Vulnerability Note VU#930345
Skype URI handling routine contains a buffer overflow
A buffer overflow in Skype may allow a remote attacker to execute code on a vulnerable system.
Skype software provides telephone service over IP networks. There is a buffer overflow in the routines that handle Skype-specific URIs (callto:// or skype://). The buffer overflow may stem from an input validation error in the Delphi routine SysUtils.WideFmtStr(...).
A remote attacker may be able to execute arbitrary code if they can persuade a user to access a Skype-specific URI with a vulnerable Skype installation.
Do not access Skype URIs from untrusted sources
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Skype Technologies||Affected||-||26 Oct 2005|
CVSS Metrics (Learn More)
This vulnerability was reported by SKY-CERT. SKY-CERT credits Mark Rowe of Pentest Limited with providing information regarding this issue.
This document was written by Jeff Gennari.
- CVE IDs: CAN-2005-3265
- Date Public: 25 Oct 2005
- Date First Published: 26 Oct 2005
- Date Last Updated: 26 Oct 2005
- Severity Metric: 10.13
- Document Revision: 14