PT-2017-2287 · Microsoft · Skype

Benjamin Kunz Mejri · Published 2017-06-26 · Updated 2017-07-05 · CVE-2017-9948

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Skype versions 7.2 through 7.36

Description The issue is caused by errors in the MSFTEDIT.dll library, leading to a stack buffer overflow. This can be exploited by a remote attacker to cause a denial of service by copying a specially crafted image file to the clipboard and then pasting it into a Skype dialog window. The vulnerability involves mishandling of remote RDP clipboard content within the message box.

Recommendations For Microsoft Skype versions 7.2 through 7.36, update to version 7.37 or later to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-01485

CVE-2017-9948

Affected Products

Skype

References · 7

• 🔥 https://vulnerability-lab.com/get_content.php?id=2071 · Exploit
• https://bdu.fstec.ru/vul/2017-01485 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9948 · Security Note
• http://securityfocus.com/bid/99281 · Note
• https://vulnerability-lab.com/get_content.php?id=2084 · Note
• https://vulnerability-db.com/?q=articles/2017/05/28/stack-buffer-overflow-zero-day-vulnerability-uncovered-microsoft-skype-v72-v735 · Note