Update: Researcher finds serious vulnerability in Skype
IDG News Service -
A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone's account, according to details posted online. Skype said it would issue a fix next week.
The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later. He said on Friday he hasn't heard a response yet.
There are some mitigating factors, such as that the attacker and victim must be friends on Skype. Also, the attack may not immediately execute when the victim logs in. Kayan said he noticed the behavior happened only after the victim logged in several times. But he said in an e-mail that once it happens the first time, "it happens with each re-login."
Skype should be checking the input into the mobile phone field and validating that it is indeed a phone number and not executable code. The problem affects the latest version of Skype, 188.8.131.52, on Windows XP, Vista and 7 as well as Mac OS X operating system.
Skype disagreed somewhat with Kayan's description of the issue, characterizing it as minor.
"Essentially it allows for one of your top contacts on Windows to display messages or redirect to websites within the SkypeHome page," said Adrian Asher, Skype's chief information security officer, in a statement.
"In order to exploit this a person would have to be a validated contact of yours and one of the most frequent people you are in contact with, and therefore very unlikely to cause any issues in the real world, however it should not be like this and will be fixed," he said.
Send news tips and comments to firstname.lastname@example.org
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- IDG Research Survey: Are you Paying Too Much for Your NMS? Feel like you're paying too much for network monitoring? You're not alone. This survey brief summarizes findings from research recently fielded by IDG...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Live Webcast 5 Steps to Assuring Quality of Experience In order to align monitoring and management practices with the true demands of the business, IT professionals must expand beyond traditional comfort zones...
- Live Webcast Master the Changing SAP Landscape with Performance Management SAP landscapes are not getting simpler. Gradually, business processes that used to be contained on a single SAP system now involve a range...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Navigating the New Wireless Landscape Thriving in the new wireless landscape View Now>> All Networking White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!