A buffer overflow in Skype may allow a remote attacker to execute code on a vulnerable system.
Skype software provides telephone service over IP networks. There is a buffer overflow in the routines that handle Skype-specific URIs (callto:// or skype://). The buffer overflow may stem from an input validation error in the Delphi routine SysUtils.WideFmtStr(...).
A remote attacker may be able to execute arbitrary code if they can persuade a user to access a Skype-specific URI with a vulnerable Skype installation.
Do not access Skype URIs from untrusted sources
This vulnerability was reported by SKY-CERT. SKY-CERT credits Mark Rowe of Pentest Limited with providing information regarding this issue.
This document was written by Jeff Gennari.
|Date First Published:||2005-10-26|
|Date Last Updated:||2005-10-26 16:49 UTC|