SKYPE-SB/2005-002: Buffer overflow in Skype-specific URI and VCARD import handling

Bulletin title:	Buffer overflow in Skype-specific URI and VCARD import handling
Bulletin ID:	SKYPE-SB/2005-002
Bulletin status:	FINAL
Date of announcement:	2005-10-25 13:00:00 +0000
Date of last revision:	2005-10-27 15:05:15 +0000
Products affected:	Skype for Windows
Vulnerability type:	Buffer overflow
CVE references:	CVE-2005-3265
Risk assessment:	HIGH
CVSS base score:	10.0 (AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N)
Cross-references:	http://qc.borland.com/wc/qcmain.aspx?d=4744 SKYPE-SB/2004-001 (formerly SSA-2004-01)

1. Problem description and brief discussion

Description

A security bug in the Skype for Windows user client has been identified and fixed.

Skype can be made to execute arbitrary code through a buffer overflow when Skype is called upon to handle malformed URLs that are in Skype-specific URI types callto:// and skype://.

In addition, Skype can be made to execute arbitrary code during importation of a VCARD that is in a specific non-standard format.

Discussion

This bug is a subsidiary effect of documented Borland Delphi bug 4744 (http://qc.borland.com/wc/qcmain.aspx?d=4744).

Skype has replaced instances of the offending routine with one that performs proper bounds-checking.

Note that this bug is similar to the issue previously reported in SKYPE-SB/2004-001 (formerly numbered as SSA-2004-01), but was not caused by a reintroduction of the previously fixed source code.

This is tracked by Mitre CVE ID CVE-2005-3265.

2. Impact and affected software

Impact

A user could cause arbitrary code to be executed if a specially- crafted Skype-specific URL is clicked or if a specially-crafted VCARD is imported.

Affected software

The following Skype clients are vulnerable to this attack:

Skype for Windows: Releases 1.1.*.0 through 1.4.*.83

3. Solution or work-around

An official fix to the issue covered by this Security Bulletin has been released. To implement this fix, update to one of the following releases of Skype. (Downloading instructions are shown in Section 4 of this Bulletin.)

Skype for Windows: Release 1.4.*.84 or later

As a work-around prior to updating the Skype software, this bug may be avoided by not selecting Skype-specific URIs and not importing VCARD records.

4. Special instructions and notes

None.

5. Software download location

The preferred method for installing security updates is to download the software directly from Skype's website, from the website of Skype's authorized partners, or from a reliable mirror site. Skype may also be safely downloaded from other locations, but in this case it is particularly important that you verify the authenticity of the download.

We recommend that once you download any Skype software that you verify its integrity by the methods listed in Section 6 of this Bulletin.

You may install Skype by running the Skype installer using the installation commands displayed under the appropriate operating system listed at http://www.skype.com/go/download/.

x86 platform, Microsoft Windows 2000 or Microsoft Windows XP: http://www.skype.com/features/skype/windows/

x86 platform, Linux: http://www.skype.com/features/skype/linux/

PPC platform, Mac OS X v10.3 (Panther) or later: http://www.skype.com/features/skype/macosx/

Pocket PC platform, Microsoft Windows Mobile 2003: http://www.skype.com/features/skype/pocketpc/

6. Authenticity verification

- Bulletin authenticity verification:

Skype security bulletins are published on Skype's web site and via mailing lists. The authenticity and integrity of a Skype security bulletins may be determined by inspecting the crypto- graphic signature that is attached to each bulletin. All Skype security bulletins are published with a valid digital signature produced by PGP.

- Software authenticity verification:

Both the Skype installer program and the Skype program that is installed by the installer are digitally signed.

For Skype software built for Microsoft Windows operating environments, the digital certificate used by Skype to sign software packages is signed by "VeriSign Class 3 Code Signing 2004 CA".

For Skype software built for Linux platforms, all packages are signed by PGP key ID 0xD66B746E, the public component of which may be downloaded from http://www.skype.com/features/skype/linux/.

- For general information about Skype security, please visit the Skype Security Resource Center at http://www.skype.com/security/.

7. Common Vulnerability Assessment System (CVSS) assessment

Skype has rated the issue covered by this Security Bulletin under the CVSS scheme as follows:

Base metrics:

Access Vector (AV) ........... Remote
Access Complexity (AC) ....... Low
Authentication (Au) .....,.... Not Required
Confidentiality Impact (C) ... Complete
Integrity Impact (I) ......... Complete
Availability Impact (A) ...... Complete
Impact Bias (B) .............. Normal

Computed CVSS base score: 10.0

Temporal metrics as of 2005-10-25

Exploitability (E) ........... Functional
Remediation Level (RL) ....... Official Fix
Report Confidence (RC) ....... Confirmed

Computed CVSS temporal score: 8.3

Skype participates in the CVSS by rating each identifiable security vulnerability against the CVSS base metrics. In addition, Skype may rate each vulnerability against temporal metrics from time to time. As suggested by the name, temporal metrics for a particular vulnerability may change from time to time.

More information about the CVSS may be obtained from the CVSS host website at http://www.first.org/cvss/.

8. Credits and additional information

This bug was referred to SKY-CERT by an external referrer, Mark Litchfield of Next Generation Security Software (NGSS), who did the research concerning VCARD importation. Based on this, Mark Rowe of Pentest Limited identified the same bug as it related to long URL handling. We would like to thank and credit these individuals for having referred this issue to Skype.

9. Bulletin release history

2005-10-25 Initial bulletin release

2005-10-27 Updated to correct credit information

10. Notices

This Skype Security Bulletin may be reproduced and distributed, provided that the Bulletin is not modified in any way and is attributed to Skype Technologies, S.A. and provided that repro- duction and distribution is performed for non-commercial purposes.

This Skype Security Bulletin is provided to you on an "AS IS" basis and may contain information provided by third parties. Skype makes no guarantees or warranties as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED.