Massive code rewrite may be required to patch Skype vulnerability

Dragon1952 · Feb 13, 2018

http://www.zdnet.com/article/skype-cannot-fix-security-bug-without-a-massive-code-rewrite/

itman · Feb 15, 2018

Another one that Microsoft is "mum" on.

Skype is reportedly refusing to patch a security vulnerability in its updater process which could allow an attacker to gain system level privileges on a vulnerable computer.

If exploited, the bug can allow a local privilege user to escalate themselves to the full "system" level rights granting access to every corner of the operating system in and attack the could easily be weaponized in a malicious script of malware.

Security researcher Stefan Kantha spotted the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library, according to ZDNet.

Kantha told the publication an attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user. When the app searches for the DLL it needs, it finds that malicious DLL first, enabling the attack the work.

Once the exploit has been installed, Skypes own built in updater keeps the software up to date but when the updater runs, another executable file is used to run the update which is vulnerable to hijacking.

The DLL hijacking attacks can be carried out on Windows, Mac and Linux and the attacks could ultimately allow an attacker to steal files. Microsoft, Skypes, parent company, was notified about the bug in September but said that issuing a fix would require the updater to go through “a large code revision,” Kantha told the publication.
Click to expand...

https://www.scmagazine.com/microsoft-reportedly-hesitant-to-fix-skype-updater-bug/article/744517/

ronjor · Feb 16, 2018

Dragon1952 said: ↑

http://www.zdnet.com/article/skype-cannot-fix-security-bug-without-a-massive-code-rewrite/
Click to expand...

Update on Skype for Windows desktop installer – version 7.40 and lower

Ellen Kilbourne [MSFT] Forum Moderator Support Engineer Article Author

The installer for the current version of Skype for Windows desktop (v8 ) does NOT have this issue, and it has been available since October, 2017.
Click to expand...

xxJackxx · Feb 16, 2018

Not happy in the least. Version 8 will not install on Windows 10 (I'm not interested in using compatibility mode) and the Microsoft Store version sucks. What's everyone else replacing it with? If they want to work this hard to discourage me from using Skype I'm more than happy to use something else.

Log in or Sign up

Massive code rewrite may be required to patch Skype vulnerability

Dragon1952 Registered Member

itman Registered Member

ronjor Global Moderator

xxJackxx Registered Member

Log in or Sign up

Massive code rewrite may be required to patch Skype vulnerability

Dragon1952 Registered Member

itman Registered Member

ronjor Global Moderator

xxJackxx Registered Member

Useful Searches