PT-2008-2209 · Microsoft · Skype

Publicado 2008-02-04 · Atualizado 2017-08-08 · CVE-2008-0583

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Skype versions 3.5.x and earlier, Skype versions 3.6.0 through 3.6.0.244

Description A cross-zone scripting issue allows remote attackers to inject arbitrary web script or HTML in the Local Machine Zone. This can be achieved through the Description and other metadata fields of a Metacafe movie submitted to the Skype video gallery. The vulnerability can be accessed via the "Add video to chat" or "Add video to mood" dialog.

Recommendations For Skype versions 3.5.x and earlier, and Skype versions 3.6.0 through 3.6.0.244, consider disabling access to the Skype video gallery until a patch is available. Restrict the use of the "Add video to chat" and "Add video to mood" dialogs to minimize the risk of exploitation. Avoid using the Description field in Metacafe movie submissions to the Skype video gallery until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0583

Produtos afetados

Skype

Referências · 6

• 🔥 http://securityfocus.com/bid/27338 · Exploit
• 🔥 http://aviv.raffon.net/2008/01/22/NoMoreVideosForYouComeBackWhenPatchAvailable.aspx · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39754 · Nota
• http://kb.cert.org/vuls/id/794236 · Nota
• http://skype.com/security/skype-sb-2008-001-update1.htm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0583 · Nota de Segurança