Skype bug may expose users to malicious code
Updated The latest version of Skype for Windows contains a security vulnerability that allows attackers to inject potentially dangerous code into a user’s phone session, a German security researcher has reported.
The XSS, or cross-site scripting, vulnerability in Skype 126.96.36.199 is the result of the voice-over-IP client failing to inspect user-supplied phone numbers for malicious code, researcher Levent Kayan said. As a result, attackers might be able to exploit the bug to inject commands or scripts that hijack the machine running the program.
A screen shot from Kayan’s website showing the injection bug in action
A Skype spokeswoman disputed Kayan’s account.
“We have had this reported to us by various media outlets and have confirmed that the person is mistaken, this is not a web window and while it does cause a phone number to be underlined, does nothing other than this,” spokeswoman Brianna Reynaud wrote in an email.
In an email to The Register, Kayan stood his ground, insisting that at a minimum, the flaw allows an attacker to create a hyperlink on a victim’s client that leads to a site of the attacker’s choosing.
“According to Skype’s spokeswoman, I wanted to tell you, that this is not really true what she said, because the entries in (home, office and mobile phone and even in “city”) are embedded via HTML,” he wrote.
Such vulnerabilities open the possibility of creating self-replicating attacks if they can be used to target users contained in each victim’s contact list. As each new user is exploited, the worm spreads virally by attacking a whole new set of people. A vulnerability reported in May for Mac versions of Skype was described as wormable, though there are no reports it was ever exploited in the wild. It’s unclear if the current vulnerability is also self-replicating.
Microsoft is in the process of acquiring the popular internet-based phone service. ®
This article was updated to add comment from Skype spokeswoman and a response from Kayan.