HITB GSEC Singapore (August 21st - 25th)
Register Online Now!
Memory Corruption Vulnerability released in Skype 5.6.59.x
Some month after the last skype vulnerability publication the experts of vulnerability-lab [Alexander Fuchs & Benjamin Kunz Mejri] demonstrated a new skype vulnerability, found in the file transfer module, by sending a file from Skype v126.96.36.199 Beta for Linux to a contact that was running Skype 188.8.131.52 on a Windows 7 x64 operating system. This transfer resulted in a stable memory corruption on the Windows7 client.
The following pictures are live crashs from the skype beta linux client to a win7 x64 client when successfully exploited by an remote attacker.
The next pictures shows the effect when the client is freezing or crashing. The software drops different access violation (read/write) messages.
The bug is located in the software when processing special crafted transfers/communication processes from a linux v184.108.40.206(Beta) client to a windows v220.127.116.11 client. The vulnerability allows the linux client user to crash the windows client on the remote way via freeze when transfering. The execution of code is not possible via violation (read/write). The bug is only verified on Acer Aspire 5738 with Intel(R) Core(TM)2 Duo & Windows 7 x64.
Vulnerable Module(s): File Transfer Linux v18.104.22.168(Beta) to Windows v22.214.171.124 Client
Verified on OS: Windows 7 - x64
Typus: Acer Aspire 5738
Processor: Intel(R) Core(TM)2 Duo - T6600 - 2x2.2 GHz
Affected OS version(s): Windows v126.96.36.199
Exploited via: Skype Linux v188.8.131.52(Beta)
The both researchers also provided a little attack scheme which shows the exploitation method behind the disclosed vulnerability.
The vulnerability has been reported in october last year (2011) to the skype security team. The latest Skype version is 184.108.40.206, which probably incorporates the fix for the memory corruption vulnerability.
Original Advisory: http://www.vulnerability-lab.com/get_content.php?id=315