SKYPE-SB/2008-001: Skype Cross Zone Scripting Vulnerability

Bulletin title:	Skype Cross Zone Scripting Vulnerability
Bulletin ID:	SKYPE-SB/2008-001
Bulletin status:	FINAL
Date of announcement:	2008-02-05 14:00:00 +0000
Products affected:	Skype for Windows
Vulnerability type:	Code injection
CVE references:
Risk assessment:	HIGH
CVSS base score:	10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cross-references:	http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx http://seclists.org/fulldisclosure/2008/Jan/0328.html http://www.skype.com/intl/en/security/skype-sb-2008-002.html

1. Problem description and brief discussion

Description

A security bug in Skype for Windows client has been identified and fixed.

Skype uses Internet Explorer web control to render HTML content. This is used also for providing "add video to mood" and "add video to chat" functionality. The bug has been discovered in Windows Skype code which allows scripts to be run in unlocked Local Zone security context of IE and execute shell.

In order to exploit this an attacker must exploit code injection vulnerability at content provider site. Such vulnerabilities were discovered in Dailymotion website, in Metacafe Pro video submission software as well as in Skype's own SkypeFind. All of them have been fixed at the time of issuing this bulletin.

Discussion

An attacker who constructs a Title of the video in a specific way in the Dailymotion gallery can cause arbitrary code to be executed on targets PC. For the vulnerability to be triggered, the target must find this video in Skype video gallery browser section. Watching the video in a Skype chat or in a mood message is safe, as Internet Explorer control is not used.

Details of vulnerability in Metacafe have not been disclosed. However the PoC has been enhanced in a way which enables to refer to the malicious video through a Skype uri which in turn can be sent directly to victims.

The proof of concept has been published by Aviv Raff and Miroslav Lucinskij.

2. Impact and affected software

Impact

A user of Skype for Windows, who has his/her Skype running and follows a link to specially crafted video may experience execution of arbitrary code without consent.

Affected software

The following Skype clients are vulnerable to this attack:

Skype for Windows:
- All releases including 3.5.*
- 3.6 releases prior and including 3.6.*.244

3. Solution or work-around

An official fix to the issue covered by this Security Bulletin has been released. The core vulnerability has been fixed by setting IE control security context to Internet Zone. To implement this fix, update to one of the following releases of Skype. (Downloading instructions are shown in Section 5 of this Bulletin.)

Skype for Windows: 3.6.*.248 or later

4. Special instructions and notes

The access to video gallery for the customers using vulnerable versions of Skype has been disabled. Customers are advised to upgrade.

5. Software download location

The preferred method for installing security updates is to download the software directly from Skype's website, from the website of Skype's authorized partners, or from a reliable mirror site. Skype may also be safely downloaded from other locations, but in this case it is particularly important that you verify the authenticity of the download.

We recommend that once you download any Skype software that you verify its integrity by the methods listed in Section 6 of this Bulletin.

x86 platform, Microsoft Windows 2000 or Microsoft Windows XP: http://www.skype.com/download/skype/windows/

x86 platform, Linux: http://www.skype.com/download/skype/linux/

PPC and x86 platforms, Mac OS X v10.3.9 or later: http://www.skype.com/download/skype/macosx/

Pocket PC platform, Microsoft Windows Mobile 2003: http://www.skype.com/download/skype/pocketpc/

6. Authenticity verification

- Bulletin authenticity verification:

Skype security bulletins are published on Skype's web site and via mailing lists. The authenticity and integrity of a Skype security bulletins may be determined by inspecting the crypto- graphic signature that is attached to each bulletin. All Skype security bulletins are published with a valid digital signature produced by PGP.

- Software authenticity verification:

Both the Skype installer program and the Skype program that is installed by the installer are digitally signed.

For Skype software built for Microsoft Windows and Mac OSX operating environments, the digital certificate used by Skype to sign software packages is signed by "VeriSign Class 3 Code Signing 2004 CA".

For Skype software built for Linux platforms, all packages are signed by PGP key ID 0xD66B746E, the public component of which may be downloaded from http://www.skype.com/download/skype/linux/.

- For general information about Skype security, please visit the Skype Security Resource Center at http://www.skype.com/security/.

7. Common Vulnerability Assessment System (CVSS) assessment

Skype has rated the issue covered by this Security Bulletin under the CVSS scheme as follows:

Base metrics as of 2008-02-05:

Access Vector (AV) ........... Network
Access Complexity (AC) ....... Low
Authentication (Au) .....,.... Not Required
Confidentiality Impact (C) ... Complete
Integrity Impact (I) ......... Complete
Availability Impact (A) ...... Complete

Computed CVSS base score: 10.0

Temporal metrics as of 2008-02-05

Exploitability (E) ........... Functional
Remediation Level (RL) ....... Workaround
Report Confidence (RC) ....... Confirmed

Computed CVSS temporal score: 9.0

Skype participates in the CVSS by rating each identifiable security vulnerability against the CVSS base metrics. In addition, Skype may rate each vulnerability against temporal metrics from time to time. As suggested by the name, temporal metrics for a particular vulnerability may change from time to time.

More information about the CVSS may be obtained from the CVSS host website at http://www.first.org/cvss/.

8. Credits and additional information

Skype would like to thank and credit Aviv Raff for having referred this problem to Skype.

9. Bulletin release history

2008-01-18 Initial bulletin release

2008-01-23 Bulletin updated

2008-02-05 Final bulletin release

10. Notices

This Skype Security Bulletin may be reproduced and distributed, provided that the Bulletin is not modified in any way and is attributed to Skype Technologies, S.A. and provided that repro- duction and distribution is performed for non-commercial purposes.

This Skype Security Bulltin is provided to you on an "AS IS" basis and may contain information provided by third parties. Skype makes no guarantees or warranties as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED.

To report a security issue to Skype, please send an e-mail that describes the problem or vulnerability to security@skype.com. Please consider securing any reports that disclose security vulnerabilities by encrypting them using the current PGP key of the Skype Computer Emergency Response Team (SKY-CERT), PGP key ID 0xAD2DF320.