PT-2008-2086 · Microsoft · Skype

Miroslav Lucinskij · Published 2008-01-24 · Updated 2021-07-23 · CVE-2008-0454

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Skype versions 3.5.x and earlier, Skype versions 3.6.0 through 3.6.0.244

Description The issue allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a movie in the Skype video gallery. This can be achieved through a search within the "Add video to chat" dialog.

Recommendations For Skype versions 3.5.x and earlier, and Skype versions 3.6.0 through 3.6.0.244, consider avoiding the use of the "Add video to chat" dialog until a fix is available. As a temporary workaround, restrict access to the Skype video gallery to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0454

Affected Products

Skype

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2008-0454 · Security Note
• http://critical.lt/?opinions/show/1470 · Note
• http://gnucitizen.org/blog/vulnerabilities-in-skype · Note
• http://securityfocus.com/archive/1/486512/100/0/threaded · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html · Note
• http://vupen.com/english/advisories/2008/0194 · Note
• http://securityfocus.com/archive/1/archive/1/486512/100/0/threaded · Note
• http://skype.com/security/skype-sb-2008-001.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39754 · Note
• http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx · Note
• http://kb.cert.org/vuls/id/248184 · Note
• http://securityfocus.com/bid/27338 · Note
• http://frsirt.com/english/advisories/2008/0194 · Note
• http://skype.com/security/skype-sb-2008-001-update1.html · Note
• http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html · Note