Real Time Analytics


Researcher finds dangerous vulnerability in Skype

Posted by and filed under Featured. You can follow any responses to this entry through the RSS 2.0. You can leave a response or trackback to this entry

A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone’s account, according to details posted online.

The problem lies in a field where a person can input their mobile phone number. Kayan wrote that a malicious user can insert JavaScript into the mobile phone field of their profile.

When one of their contacts comes online, the malicious user’s profile will be updated, and the JavaScript will be executed when the other contact logs in. Kayan wrote that the other person’s session could be hijacked, and it may be possible to gain control of that person’s computer. An attacker could also change the password on someone’s account.

There are some mitigating factors, such as that the attacker and victim must be friends on Skype. Also, the attack may not immediately execute when the victim logs in. Kayan said he noticed the behavior happened only after the victim logged in several times. But he said in an e-mail that once it happens the first time, “it happens with each re-login.”

Skype should be checking the input into the mobile phone field and validating that it is indeed a phone number and not executable code. The problem affects the latest version of Skype, 5.3.0.120, on Windows XP, Vista and 7 as well as Mac OS X operating system.

written by

Contact Info

Tags: , , ,

You must be logged in to post a comment Login

Revealed: Sonam has a tongue piercing, two tattoos
Top Viruses and Virus Hoaxes In July

All logos, pictures and advertisements are the property for their respective owners