-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ SKYPE SECURITY BULLETIN SKY-CERT Bulletin title: Buffer overflow in callto: URI handling Bulletin ID: SKYPE-SB/2004-002 Bulletin status: FINAL Date of announcement: 2004-11-17 17:41:20 +0000 Date of last revision: 2005-10-24 10:22:16 +0000 Products affected: Skype for Windows Vulnerability type: Buffer overflow CVE references: CVE-2004-1114 Risk assessment: HIGH CVSS base score: 10.0 (AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N) Cross-references: SSA-2004-02 (replaced with this bulletin) Table of contents: 1. Problem description and brief discussion 2. Impact and affected software 3. Solution or work-around 4. Special instructions and notes 5. Software download location 6. Authenticity verification 7. Common Vulnerability Scoring System (CVSS) assessment 8. Credits and additional information 9. Bulletin release history 10. Notices ________________________________________________________________________ 1. Problem description and brief discussion Description ----------- A security bug in the Skype for Windows user client has been identified and fixed. A buffer overflow vulnerability exists in the way Skype parses command-line arguments. If Skype is executed with a command line longer than approximately 4096 characters, Skype would report an Access Violation and terminate. However, an attacker could use this vulnerability to overwrite the program stack with data given in the command line, thus giving rise to the possibility of injected code execution. Discussion ---------- This vulnerability could be exploited in conjunction with the Skype- specific callto: URL. Once registered, Windows passes any callto: URL to Skype as a command-line argument. Therefore, if the user follows a specially-crafted long callto: URL, the victim instance of Skype could execute arbitrary code supplied by the attacker in the URL. This bug was originally announced in Skype Security Announcement number SSA-2004-02. This bulletin is identical to and replaces SSA-2004-02, but changes the format of the notice. This is tracked by Mitre CVE ID CVE-2004-1114. ________________________________________________________________________ 2. Impact and affected software Impact ------ By inducing a user to click on a specially crafted callto: URL on a web page or in an HTML e-mail message, an attacker could possibly execute arbitrary code with the privileges of the user. The attacker could also cause Skype to crash. Affected software ----------------- The following Skype clients are vulnerable to this attack: Skype for Windows: Releases 1.0.*.94 through 1.0.*.98 ________________________________________________________________________ 3. Solution or work-around An official fix to the issue covered by this Security Bulletin has been released. To implement this fix, update to one of the following releases of Skype. (Downloading instructions are shown in Section 4 of this Bulletin.) Skype for Windows: Release 1.0.*.100 or later ________________________________________________________________________ 4. Special instructions and notes None. ________________________________________________________________________ 5. Software download location The preferred method for installing security updates is to download the software directly from Skype's website, from the website of Skype's authorized partners, or from a reliable mirror site. Skype may also be safely downloaded from other locations, but in this case it is particularly important that you verify the authenticity of the download. We recommend that once you download any Skype software that you verify its integrity by the methods listed in Section 6 of this Bulletin. You may install Skype by running the Skype installer using the installation commands displayed under the appropriate operating system listed at http://www.skype.com/download/. x86 platform, Microsoft Windows 2000 or Microsoft Windows XP: http://www.skype.com/products/skype/windows/ x86 platform, Linux: http://www.skype.com/products/skype/linux/ PPC platform, Mac OS X v10.3 (Panther) or later: http://www.skype.com/products/skype/macosx/ Pocket PC platform, Microsoft Windows Mobile 2003: http://www.skype.com/products/skype/pocketpc/ ________________________________________________________________________ 6. Authenticity verification - Bulletin authenticity verification: Skype security bulletins are published on Skype's web site and via mailing lists. The authenticity and integrity of a Skype security bulletins may be determined by inspecting the crypto- graphic signature that is attached to each bulletin. All Skype security bulletins are published with a valid digital signature produced by PGP. - Software authenticity verification: Both the Skype installer program and the Skype program that is installed by the installer are digitally signed. For Skype software built for Microsoft Windows operating environments, the digital certificate used by Skype to sign software packages is signed by "VeriSign Class 3 Code Signing 2004 CA". For Skype software built for Linux platforms, all packages are signed by PGP key ID 0xD66B746E, the public component of which may be downloaded from http://www.skype.com/products/skype/linux/. - For general information about Skype security, please visit the Skype Security Resource Center at http://www.skype.com/security/. ________________________________________________________________________ 7. Common Vulnerability Assessment System (CVSS) assessment Skype has rated the issue covered by this Security Bulletin under the CVSS scheme as follows: Base metrics: Access Vector (AV) ........... Remote Access Complexity (AC) ....... Low Authentication (Au) .....,.... Not Required Confidentiality Impact (C) ... Complete Integrity Impact (I) ......... Complete Availability Impact (A) ...... Complete Impact Bias (B) .............. Normal Computed CVSS base score: 10.0 Temporal metrics as of 2005-10-24 Exploitability (E) ........... Functional Remediation Level (RL) ....... Official Fix Report Confidence (RC) ....... Confirmed Computed CVSS temporal score: 8.3 Skype participates in the CVSS by rating each identifiable security vulnerability against the CVSS base metrics. In addition, Skype may rate each vulnerability against temporal metrics from time to time. As suggested by the name, temporal metrics for a particular vulnerability may change from time to time. More information about the CVSS may be obtained from the CVSS host website at http://www.first.org/cvss/. ________________________________________________________________________ 8. Credits and additional information Skype would like to credit and thank Fabian Becker for referring this bug for us for resolution. ________________________________________________________________________ 9. Bulletin release history 2004-11-17 Initial bulletin release 2005-10-24 Updated to change the bulletin numbering and format, as well as to add CVSS scoring ________________________________________________________________________ 10. Notices Copyright 2004-2005 Skype Technologies, S.A. All rights reserved. This Skype Security Bulletin may be reproduced and distributed, provided that the Bulletin is not modified in any way and is attributed to Skype Technologies, S.A. and provided that repro- duction and distribution is performed for non-commercial purposes. This Skype Security Bulltin is provided to you on an "AS IS" basis and may contain information provided by third parties. Skype makes no guarantees or warranties as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. ======================================================================== To report a security issue to Skype, please send an e-mail that describes the problem or vulnerability to . Please consider securing any reports that disclose security vulnerabilities by encrypting them using the PGP key of the Skype Computer Emergency Response Team (SKY-CERT), PGP key ID 0x019DBB43. ======================================================================== - -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1y2o+QJFIMBnbtDEQJqKgCgmx30/YgtISkAFZt1tRRkPEVc1uAAn39G rweP5Zpf+ZJttaU4g1FbDlly =VMQp - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1zoYuQJFIMBnbtDEQJrNQCghYPO3iE6Oy8DqXKYMV+P+qp9+9gAn33N yuytbRwZarjMjYKWH9JoJYZa =e6+z -----END PGP SIGNATURE-----