Update: Researcher finds serious vulnerability in Skype
IDG News Service -
A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone's account, according to details posted online. Skype said it would issue a fix next week.
The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later. He said on Friday he hasn't heard a response yet.
There are some mitigating factors, such as that the attacker and victim must be friends on Skype. Also, the attack may not immediately execute when the victim logs in. Kayan said he noticed the behavior happened only after the victim logged in several times. But he said in an e-mail that once it happens the first time, "it happens with each re-login."
Skype should be checking the input into the mobile phone field and validating that it is indeed a phone number and not executable code. The problem affects the latest version of Skype, 220.127.116.11, on Windows XP, Vista and 7 as well as Mac OS X operating system.
Skype disagreed somewhat with Kayan's description of the issue, characterizing it as minor.
"Essentially it allows for one of your top contacts on Windows to display messages or redirect to websites within the SkypeHome page," said Adrian Asher, Skype's chief information security officer, in a statement.
"In order to exploit this a person would have to be a validated contact of yours and one of the most frequent people you are in contact with, and therefore very unlikely to cause any issues in the real world, however it should not be like this and will be fixed," he said.
Send news tips and comments to firstname.lastname@example.org
- SharePlan Security SharePlan is a continuous, secure, enterprise-ready file sync and share platform that facilitates smart, real-time collaboration across all devices.
- Three Ways Your DNS Can Impact DDoS Attacks Domain Name System (DNS) plays a big role in consumers' day-to-day Internet usage and is a critical factor when it comes to distributed...
- 3 Reasons Why You Need Real User Web Performance Measurements Learn why a traditional (technical) understanding of website performance needs to be replaced with a competitive one, a model where performance equates to...
- The Winter Games - Your Way During the 2014 Winter Olympics, video streams from the Akamai network reached devices internationally. Learn how Akamai provided stream security and analytics capabilities...
- Online Video and Web Traffic: Sochi 2014 Winter Olympic Games Over 25 leading global broadcasters worked with Akamai to deliver the action, excitement and inspiration of Sochi because they understand online viewers expect...
- Video surveillance for IT: maximum image quality, minimum bandwidth Join us on Thursday, May 8th at 1 p.m. EST when Willem Ryan, Senior Product Marketing Manager at Avigilon, will discuss how IT... All Networking White Papers | Webcasts