PT-2006-3277 · Microsoft · Skype

Brett Moore · Published 2006-05-19 · Updated 2024-02-13 · CVE-2006-2312

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Skype versions 2.0..104 through 2.5..78

Description The issue is an argument injection vulnerability in the URI handler that allows remote authorized attackers to download arbitrary files via a crafted URL. This can lead to unauthorized information disclosure when a malicious user sends a crafted URL to a targeted user, resulting in a loss of confidentiality.

Recommendations For Skype versions 2.0..104 through 2.5..78, avoid using the URI handler until a patch is available. As a temporary workaround, consider restricting access to the URI handler to minimize the risk of exploitation.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2006-2312

Affected Products

Skype

References · 13

• http://vupen.com/english/advisories/2006/1871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2312 · Security Note
• http://secunia.com/advisories/20154 · Vendor Advisory
• http://kb.cert.org/vuls/id/466428 · Note
• http://osvdb.org/25658 · Note
• http://frsirt.com/english/advisories/2006/1871 · Note
• http://xforce.iss.net/xforce/xfdb/26557 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0549.html · Note
• http://skype.com/security/skype-sb-2006-001.html · Note
• http://securityfocus.com/archive/1/archive/1/434707/30/4860/threaded · Note
• http://securityfocus.com/archive/1/434707/30/4860/threaded · Note
• http://securityfocus.com/bid/18038 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26557 · Note