PT-2008-2086 · Microsoft · Skype

Miroslav Lucinskij · Publicado 2008-01-24 · Atualizado 2021-07-23 · CVE-2008-0454

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Skype versions 3.5.x and earlier, Skype versions 3.6.0 through 3.6.0.244

Description The issue allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a movie in the Skype video gallery. This can be achieved through a search within the "Add video to chat" dialog.

Recommendations For Skype versions 3.5.x and earlier, and Skype versions 3.6.0 through 3.6.0.244, consider avoiding the use of the "Add video to chat" dialog until a fix is available. As a temporary workaround, restrict access to the Skype video gallery to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0454

Produtos afetados

Skype

Referências · 16

• http://critical.lt/?opinions/show/1470 · Nota
• http://gnucitizen.org/blog/vulnerabilities-in-skype · Nota
• http://securityfocus.com/archive/1/486512/100/0/threaded · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html · Nota
• http://vupen.com/english/advisories/2008/0194 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0454 · Nota de Segurança
• http://securityfocus.com/archive/1/archive/1/486512/100/0/threaded · Nota
• http://skype.com/security/skype-sb-2008-001.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39754 · Nota
• http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx · Nota
• http://kb.cert.org/vuls/id/248184 · Nota
• http://securityfocus.com/bid/27338 · Nota
• http://frsirt.com/english/advisories/2008/0194 · Nota
• http://skype.com/security/skype-sb-2008-001-update1.html · Nota
• http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html · Nota