PT-2017-2287 · Microsoft · Skype

Benjamin Kunz Mejri · Publicado 2017-06-26 · Atualizado 2017-07-05 · CVE-2017-9948

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Skype versions 7.2 through 7.36

Description The issue is caused by errors in the MSFTEDIT.dll library, leading to a stack buffer overflow. This can be exploited by a remote attacker to cause a denial of service by copying a specially crafted image file to the clipboard and then pasting it into a Skype dialog window. The vulnerability involves mishandling of remote RDP clipboard content within the message box.

Recommendations For Microsoft Skype versions 7.2 through 7.36, update to version 7.37 or later to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2017-01485

CVE-2017-9948

Produtos afetados

Skype

Referências · 7

• 🔥 https://vulnerability-lab.com/get_content.php?id=2071 · Exploit
• https://bdu.fstec.ru/vul/2017-01485 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9948 · Aviso do Fabricante
• http://securityfocus.com/bid/99281 · Nota
• https://vulnerability-lab.com/get_content.php?id=2084 · Nota
• https://vulnerability-db.com/?q=articles/2017/05/28/stack-buffer-overflow-zero-day-vulnerability-uncovered-microsoft-skype-v72-v735 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9948 · Nota de Segurança