exploit the possibilities

Skype For Linux Denial Of Service / HTML Injection

Skype For Linux Denial Of Service / HTML Injection
Posted Jan 4, 2010
Authored by crossbower, emgent

Skype for Linux versions 2.1 Beta and below suffer from some odd denial of service and html injection issues that can assist phishing attacks.

tags | exploit, denial of service
systems | linux
MD5 | ca6b3f75f345f95951e81db5aa3a0fae

Skype For Linux Denial Of Service / HTML Injection

Change Mirror Download
# Title: Skype for Linux (<=2.1 Beta) multiple strange behavior
# Author: Emanuele Gentili (Emgent), Emanuele Acri (Crossbower)
# Contacts: emgent@backtrack.it, crossbower@backtrack.it
# Published: 2010-01-04
# Software Link: http://www.skype.com/intl/it/download/skype/linux/
# Version: <=2.1 Beta (the latest version)
# Tested on: Ubuntu 8.10, Debian 6.0 Testing
# Special greetz: Backtrack-Italy Community

Vulnerability Description:
The latest Linux version of Skype (2.1 Beta) is affected by several strange
behaviors that may lead to not_very_serious vulnerabilities.
We have found:
- Denial of Service (CPU 100%) in 'SED' feature
- Various and harmless local buffer overflows
- QT HTML injection, Pseudo-XSS (c00l and strange)

Vulnerabilies analysis:

[+] Denial of Service (CPU 100%) in 'SED' feature [+]
Using multiple times the SED feature can DoS a remote client (CPU 100%),
and prevent the normal use of Skype, especially the voice conversations.
After the DoS the program must be restarted.
Affected users: all users in buddylist or not, but not people that have
blocked the attacker's contact.

- Proof of Concept
(xdotool required, 'apt-get install xdotool' on debian-like distros):
1) The attacker send a long spaced string: this command waits 5 second and then
types the string in the currently selected field...
(you should select the textarea of a chat with the cursor before it types):
sleep 5 && xdotool type "`perl -e "print 'S 'x44801"`" && xdotool key Return
2) The attacker use SED to rewrite the string. Command:
sleep 5 && xdotool type 's/../' && xdotool type "`perl -e "print 'S 'x44801"`" && xdotool type '/' && xdotool key Return
3) DoS on attacker and victim...

[+] Local Buffer Overflows [+]
Local Bofs when you try to send SMS and call phone numbers that are not well
formatted. A BoF occurs also when the string of the previous attack is 89601
characters long.
The buffer overflows are caused by an improper use of memcpy(), but don't
represent a security hole (just poorly written software...).

[+] QT HTML injection, Pseudo-XSS [+]
The program accept input text as HTML code in the GUI, without filtering.
It's possible to use this behavior to manipulate the GUI of the program
even remotely.
Affected input fields:
Local only: Contact search, Select file Dialog Box, Profile TextArea.
Remote (and persistent): Homepage field in Profile.

- Proof of Concept:
Just type this string in the various input fields and see if it's interpreted:
"><h1><"

- Phishing proof of concept:
If you type this string in your profile (Homepage field), 'www.google.com' will
be displayed, but the link points to -> http://backtrack.it:
backtrack.it">www.google.it<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>

[+] Conclusion [+]
There is not much new to say: Skype for Linux sucks.
Is Skype interested in doing a good job or not?
When will we have a decent version of Skype for Linux?
Skype for Linux: Where's the R-E-S-P-E-C-T? (http://www.linuxjournal.com/content/skype-linux-wheres-r-e-s-p-e-c-t)

Bye bye from Backtrack Italy Core Team,
have a nice day...

Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    8 Files
  • 24
    Sep 24th
    15 Files
  • 25
    Sep 25th
    4 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close