PT-2006-3277 · Microsoft · Skype

Brett Moore · Publicado 2006-05-19 · Atualizado 2024-02-13 · CVE-2006-2312

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Skype versions 2.0..104 through 2.5..78

Description The issue is an argument injection vulnerability in the URI handler that allows remote authorized attackers to download arbitrary files via a crafted URL. This can lead to unauthorized information disclosure when a malicious user sends a crafted URL to a targeted user, resulting in a loss of confidentiality.

Recommendations For Skype versions 2.0..104 through 2.5..78, avoid using the URI handler until a patch is available. As a temporary workaround, consider restricting access to the URI handler to minimize the risk of exploitation.

Correção

Argument Injection

Enumeração de Fraquezas

CWE-88

Identificadores relacionados

CVE-2006-2312

Produtos afetados

Skype

Referências · 13

• http://kb.cert.org/vuls/id/466428 · Nota
• http://osvdb.org/25658 · Nota
• http://frsirt.com/english/advisories/2006/1871 · Nota
• http://vupen.com/english/advisories/2006/1871 · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/26557 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0549.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2312 · Nota de Segurança
• http://skype.com/security/skype-sb-2006-001.html · Nota
• http://securityfocus.com/archive/1/archive/1/434707/30/4860/threaded · Nota
• http://securityfocus.com/archive/1/434707/30/4860/threaded · Nota
• http://securityfocus.com/bid/18038 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26557 · Nota
• http://secunia.com/advisories/20154 · Aviso do Fabricante