HTTP: Skype URI Handler Heap Corruption Exploit

This signature detects attempts to exploit a known vulnerability in Skype's Skype4Com URI handler. An attacker can create a malicious Web site containing Web pages with dangerous SWkype URl's, which if accessed by a victim, allows the attacker to gain control of the victim's client browser, Skype Technologies' clients prior to 3.6 Gold are vulnerable.

Extended Description

Skype is prone to a remote heap-based memory-corruption vulnerability because of a flaw in the application's URI handler. Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected application, facilitating the compromise of affected computers. Versions prior to Skype 3.6.0.216 for Windows are affected. It is currently unknown if other platforms are affected.

Affected Products

Skype_technologies skype

References

BugTraq: 26748

CVE: CVE-2007-5989

URL: http://securitytracker.com/alerts/2007/Dec/1019056.html

Short Name

HTTP:STC:SKYPE4COM

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Skype URI Handler Heap Corruption Exploit

Extended Description

Affected Products

References

Found a potential security threat?