CVE Discovered in SKYPE VoiP SoftPhone

SKYPE-SB/2005-002: Buffer overflow in Skype-specific URI and VCARD import handling
Bulletin title: Buffer overflow in Skype-specific URI andVCARD import handling
Bulletin ID: SKYPE-SB/2005-002
Bulletin status: FINAL
Date of announcement: 2005-10-25 13:00:00 +0000
Date of last revision: 2005-10-27 15:05:15 +0000
Products affected: Skype for Windows
Vulnerability type: Buffer overflow
CVE references: CVE-2005-3265 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-3265
Risk assessment: HIGH
CVSS base score: 10.0 (AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N)
Cross-references: http://qc.borland.com/wc/qcmain.aspx?d=4744SKYPE-SB/2004-001 (formerly SSA-2004-01)
Table of contents:
Problem description and brief discussion
Impact and affected software
Solution or work-around
Special instructions and notes
Software download location
Authenticity verification
Common Vulnerability Scoring System (CVSS) assessment
Credits and additional information
Bulletin release history
Notices
1. Problem description and brief discussion
Description
A security bug in the Skype for Windows user client has beenidentified and fixed.
Skype can be made to execute arbitrary code through a bufferoverflow when Skype is called upon to handle malformed URLs thatare in Skype-specific URI types callto:// and skype://.
In addition, Skype can be made to execute arbitrary code duringimportation of a VCARD that is in a specific non-standard format.
Discussion
This bug is a subsidiary effect of documented Borland Delphibug 4744 (http://qc.borland.com/wc/qcmain.aspx?d=4744).
Skype has replaced instances of the offending routine with onethat performs proper bounds-checking.
Note that this bug is similar to the issue previously reported inSKYPE-SB/2004-001 (formerly numbered as SSA-2004-01), but was notcaused by a reintroduction of the previously fixed source code.
This is tracked by Mitre CVE ID CVE-2005-3265.
2. Impact and affected software
Impact
A user could cause arbitrary code to be executed if a specially-crafted Skype-specific URL is clicked or if a specially-craftedVCARD is imported.
Affected software
The following Skype clients are vulnerable to this attack:
Skype for Windows:Releases 1.1.*.0 through 1.4.*.83
3. Solution or work-around
An official fix to the issue covered by this Security Bulletin hasbeen released. To implement this fix, update to one of thefollowing releases of Skype. (Downloading instructions are shownin Section 4 of this Bulletin.)
Skype for Windows:Release 1.4.*.84 or later
As a work-around prior to updating the Skype software, this bug maybe avoided by not selecting Skype-specific URIs and not importingVCARD records.
4. Special instructions and notes
None.
5. Software download location
The preferred method for installing security updates is to downloadthe software directly from Skype's website, from the website ofSkype's authorized partners, or from a reliable mirror site. Skypemay also be safely downloaded from other locations, but in thiscase it is particularly important that you verify the authenticityof the download.
We recommend that once you download any Skype software that youverify its integrity by the methods listed in Section 6 of thisBulletin.
You may install Skype by running the Skype installer using theinstallation commands displayed under the appropriate operatingsystem listed at http://www.skype.com/download/.
x86 platform, Microsoft Windows 2000 or Microsoft Windows XP:http://www.skype.com/products/skype/windows/
x86 platform, Linux:http://www.skype.com/products/skype/linux/
PPC platform, Mac OS X v10.3 (Panther) or later:http://www.skype.com/products/skype/macosx/
Pocket PC platform, Microsoft Windows Mobile 2003:http://www.skype.com/products/skype/pocketpc/
6. Authenticity verification
- Bulletin authenticity verification:
Skype security bulletins are published on Skype's web site andvia mailing lists. The authenticity and integrity of a Skypesecurity bulletins may be determined by inspecting the crypto-graphic signature that is attached to each bulletin. All Skypesecurity bulletins are published with a valid digital signatureproduced by PGP.
- Software authenticity verification:
Both the Skype installer program and the Skype program that isinstalled by the installer are digitally signed.
For Skype software built for Microsoft Windows operatingenvironments, the digital certificate used by Skype to signsoftware packages is signed by "VeriSign Class 3 Code Signing 2004CA".
For Skype software built for Linux platforms, all packages aresigned by PGP key ID 0xD66B746E, the public component of which maybe downloaded from http://www.skype.com/products/skype/linux/.
- For general information about Skype security, please visit theSkype Security Resource Center at http://www.skype.com/security/.
7. Common Vulnerability Assessment System (CVSS) assessment
Skype has rated the issue covered by this Security Bulletin underthe CVSS scheme as follows:
Base metrics:
Access Vector (AV) ........... RemoteAccess Complexity (AC) ....... LowAuthentication (Au) .....,.... Not RequiredConfidentiality Impact (C) ... CompleteIntegrity Impact (I) ......... CompleteAvailability Impact (A) ...... CompleteImpact Bias (B) .............. Normal
Computed CVSS base score: 10.0
Temporal metrics as of 2005-10-25
Exploitability (E) ........... FunctionalRemediation Level (RL) ....... Official FixReport Confidence (RC) ....... Confirmed
Computed CVSS temporal score: 8.3
Skype participates in the CVSS by rating each identifiable securityvulnerability against the CVSS base metrics. In addition, Skypemay rate each vulnerability against temporal metrics from time totime. As suggested by the name, temporal metrics for a particularvulnerability may change from time to time.
More information about the CVSS may be obtained from the CVSS hostwebsite at http://www.first.org/cvss/.
8. Credits and additional information
This bug was referred to SKY-CERT by an external referrer, Mark Litchfield of Next Generation Security Software (NGSS), who did the research concerning VCARD importation. Based on this, Mark Rowe of Pentest Limited identified the same bug as it related to long URL handling. We would like to thank and credit these individuals for having referred this issue to Skype.
9. Bulletin release history
2005-10-25 Initial bulletin release
2005-10-27 Updated to correct credit information
10. Notices
Copyright 2005 Skype Technologies, S.A. All rights reserved.
This Skype Security Bulletin may be reproduced and distributed,provided that the Bulletin is not modified in any way and isattributed to Skype Technologies, S.A. and provided that repro-duction and distribution is performed for non-commercial purposes.
This Skype Security Bulletin is provided to you on an "AS IS" basisand may contain information provided by third parties. Skype makesno guarantees or warranties as to the information contained herein.ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUTLIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULARPURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED.

I'm doing some research on VoIP Security - Thought you would like this one for the good old fashioned PSTN...

Most people think that the standard weapon used by most private investigators is a gun. The fact is, the most powerful weapon a private investigator uses is the telephone. Knowing all you can about them when practicing your profession is important. It's the telephone, not a gun that is the most important piece of equipment a private investigator uses. The telephone brings you both business both new and old and is the one major communications medium you obtain information with. Product knowledge on it's use as it relates to your profession is of extreme importance. This article gives you some general but little known tips about private investigators use of their major weapon, the telephone. Some of them employ little techniques that are quite useful well others require special equipment. In the case of those that require special equipment, I'll lead you right to the web page for review.

Follow this link for more...http://www.pimall.com/nais/n.20telcotips.html

Homeland Security inches toward makeover

A congressional spending bill, scheduled for the president's signature Tuesday, backs an earlier reorganization plan to further empower cybersecurity.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 11:50:14 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/homeland_securi_1.html

Cisco extends NAC security to switches

Cisco is adding new security software to all its products including Ethernet switches and wireless gear.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 11:35:13 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/cisco_extends_n.html

As threats evolve, defenses must adapt

Also: Cutting the cord on local service?
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 11:34:12 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/as_threats_evol_1.html

Windows patch backfires on the security-minded

People who tweaked their OS settings are getting hit hardest by a flawed Microsoft update meant to fix a serious flaw.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 11:28:11 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/windows_patch_b_1.html

Photo: LeapFrog's Fly pen

The "pentop computer" is a talking, computerized pen that can translate words into other languages.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 11:15:10 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/photo_leapfrogs.html

17 Oct W32/Leebad-A

more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 11:14:09 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/17_oct_w32leeba_1.html

Samy opens new front in worm war

Security experts fear would-be attackers will copy the worm, which exploits an unaddressed scripting flaw.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 10:59:08 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/samy_opens_new_1.html

17 Oct W32/Mytob-FA

more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 10:58:07 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/17_oct_w32mytob.html

17 Oct Troj/Bancban-AN

more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 10:56:06 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/17_oct_trojbanc.html

Samy worm opens new front in malware war

Security experts fear malware writers will copy a new worm that exploits an unaddressed scripting vulnerability.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 10:48:05 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/samy_worm_opens.html

As threats evolve, defenses must adapt

Also: Cutting the cord on local service?
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 10:34:04 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/as_threats_evol_2.html

Photos: Aliens in London

In-depth exhibit examining the possibility of life on other worlds opens at the Science Museum in London.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 10:28:03 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/photos_aliens_i.html

Nintendo DS Trojan Author

You have to wonder about the intellect and morals of some people. Some guy who calls himself DarkFader decided to copycat the first Sony PSP Trojan and create one of his own targeting the Nintendo DS handheld. The DSBrick Trojan... more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 10:13:02 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/nintendo_ds_tro.html

European information security specialists 'justifying existence'

IT Security professionals think they are becoming more influential according to the latest study from Infosec

more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 9:58:01 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/european_inform_1.html

Photos: Sony venture expands Walkman phone line

The W900 from Sony Ericsson takes calls and pictures, and makes music. It's geared for new 3G services.
more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 9:45:00 PMContent source: http://www.antivirus-solutions.com/archives/2005/10/photos_sony_ven.html

Changing Passwords for Key User Accounts

I must warn all readers that this article is direct and aimed to make you feel a bit uncomfortable. The goal is to expose a few vulnerabilities in your network, so that they can be fixed. However, my experience and research has proven that most companies fall into the same bucket when it comes to these vulnerabilities. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 9:34:59 PMContent source: http://www.WindowSecurity.com/articles/Changing-Passwords-Key-User-Accounts.html

First Look at Windows Vista: Secure at Last?

In the early days of Windows operating systems, security was not at the forefront of computer users' priorities as it is today especially for home computer users. Now that the vast majority of systems are connected to the Internet, wireless networks have popped up everywhere, and we're much more vulnerable to viruses and attacks, security is a necessity. With the release of each new version, Microsoft has focused more and more on protecting the system from inadvertent and deliberate security breaches, and the culmination of those efforts is Windows Vista (formerly known as Longhorn), the next generation of their client operating system that's expected to be released sometime in 2006. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 9:19:59 PMContent source: http://www.WindowSecurity.com/articles/First-Look-Windows-Vista-Secure-Last.html

Standardization and the security appliance

There is a dizzying array of appliances out there today, which will address almost every security concern. Problem is that the vendors are all touting that they can accomplish this performance benchmark or task for you. There would be little point in a vendor making outright falsifications about their wares, but it would surely be nice to have them ascertained to a certain degree by an independent source. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 9:18:57 PMContent source: http://www.WindowSecurity.com/articles/Standardization-security-appliance.html

Review of Security Planning Guides from Microsoft

This article reviews the recommendations of several recently released security planning guides from Microsoft that deal with securing administrator accounts and implementing smart card authentication in enterprise environments. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 9:12:55 PMContent source: http://www.WindowSecurity.com/articles/Review-Security-Planning-Guides-Microsoft.html

Managed E-Mail Security Services: Is it the right solution for your network?

Email communications are essential to getting the job done in today's business world, but many companies are overwhelmed by spam, the security risks of e-mail borne viruses and worms and liability implications of e-mail containing pornography or other undesirable content. It's getting harder and harder for network administrators to keep it all under control. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 9:08:53 PMContent source: http://www.WindowSecurity.com/articles/Managed-E-Mail-Security-Services-right-solution-network.html

Packet analysis tools and methodology (Part 4)

In the last part of this article series we will take a look at the alarms generated by myself. This binary log will include several attacks, and some general surfing. We now need to take a look, and separate the chaff from the wheat. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 8:58:52 PMContent source: http://www.WindowSecurity.com/articles/Packet-analysis-tools-methodology-Part4.html

Windows Vista and Principle of Least Privilege

It is not surprising that Microsoft is getting on the bandwagon for implementing the Principle of Least Privilege for their next operating system named Windows Vista. This article will investigate some of the current issues with least privilege and investigate the reality of what Microsoft is proposing with Windows Vista. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 8:45:51 PMContent source: http://www.WindowSecurity.com/articles/Windows-Vista-Principle-Least-Privilege.html

Packet analysis tools and methodology (Part 3)

It has arguably gotten easier to exploit computers now due to the abundance of attack tools out there today. One of the most powerful ones is the Metasploit Framework. We will take a look at it in this article. more...

NetClarity - Preemptive, Proactive Protection.
Originally Posted on 10/17/2005 8:41:45 PMContent source: http://www.WindowSecurity.com/articles/Packet-analysis-tools-methodology-Part3.html

PROACTIVELY PROTECT YOUR NETWORK-BASED ASSETS

Organizations of all sizes invest billions of dollars each year on network security technologies. Yet they still continue to fall prey to denial of service attacks, fast moving viruses and blended threats, hackers and worms.

A single enterprise can spend millions per year on IDS, firewalls and anti-virus software, while the real network security culprits – common vulnerabilities and exposures (CVEs) – go largely undetected and uncorrected. CVEs are the systemic cause of over 90% of all network security breaches.

While it’s true that managing vulnerabilities is an arduous task and organizations have limited resources, the risks and costs to the enterprise are far greater if these weaknesses are not addressed.

Today’s networks are at risk. Not just because hackers are out there, but also because in a mobile world, any device can pick up a virus or Trojan or have a vulnerability that opens just enough of a window to your network that a hacker can exploit it to gain access. Just one CVE® in your network and you may be in trouble. CVE is the Standard by which all information security professionals will be judged and the litmus test against regulatory compliance including GLBA, HIPAA, 21 CFR FDA 11, E-Sign and SO-404 as relates to information assets.


DO YOU SPEAK CVE?
The most important information security question you need to answer is “Do You Speak CVE?” If you do not, then no matter how much you spend on INFOSEC countermeasures, you’ll never fully understand why you are experiencing downtime and successful hacker attacks. Not to mention the regulatory compliance risk you face.

Common Vulnerabilities and Exposures (CVE) is a list or dictionary that provides common names for publicly known information security vulnerabilities and exposures. Using a common name makes it easier to share data across separate databases and tools that until now were not easily integrated. This makes CVE the key to information sharing. If a report from one of your security tools incorporates CVE names, you may then quickly and accurately access fix information in one or more separate CVE-compatible databases to remediate the problem.

CVE – An Industry Standard funded by the Department of Homeland Security – Operated by MITRE.

CVE is:
· One name for one vulnerability or exposure
· One standardized description for each vulnerability or exposure
· A dictionary rather than a database
· How disparate databases and tools can "speak" the same language
· The way to interoperability and better security coverage
· A basis for evaluation among tools and databases
· Accessible for review or download from the Internet
· Industry-endorsed via the CVE Editorial Board

Some CVEs are currently Candidates (CANs) – keep an eye out on both CVEs and CANidate CVEs.

Example CANdidate CVE:
CAN-2003-0352 (under review)
Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message.

What exploited this CVE? Blaster, Msblast, LovSAN and the Nachi and Welchia worms causing massive downtime and financial losses.