PT-2008-2209 · Microsoft · Skype

Published 2008-02-04 · Updated 2017-08-08 · CVE-2008-0583

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Skype versions 3.5.x and earlier, Skype versions 3.6.0 through 3.6.0.244

Description A cross-zone scripting issue allows remote attackers to inject arbitrary web script or HTML in the Local Machine Zone. This can be achieved through the Description and other metadata fields of a Metacafe movie submitted to the Skype video gallery. The vulnerability can be accessed via the "Add video to chat" or "Add video to mood" dialog.

Recommendations For Skype versions 3.5.x and earlier, and Skype versions 3.6.0 through 3.6.0.244, consider disabling access to the Skype video gallery until a patch is available. Restrict the use of the "Add video to chat" and "Add video to mood" dialogs to minimize the risk of exploitation. Avoid using the Description field in Metacafe movie submissions to the Skype video gallery until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-0583

Affected Products

Skype

References · 6

• 🔥 http://securityfocus.com/bid/27338 · Exploit
• 🔥 http://aviv.raffon.net/2008/01/22/NoMoreVideosForYouComeBackWhenPatchAvailable.aspx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0583 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39754 · Note
• http://kb.cert.org/vuls/id/794236 · Note
• http://skype.com/security/skype-sb-2008-001-update1.htm · Note