----------------------------------------------------------------------


Use WSUS to deploy 3rd party patches

Public BETA
http://secunia.com/vulnerability_scanning/corporate/wsus_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
Skype URI Handling "/Datapath" Vulnerability

SECUNIA ADVISORY ID:
SA38908

VERIFY ADVISORY:
http://secunia.com/advisories/38908/

DESCRIPTION:
Paul Craig has reported a vulnerability in Skype, which can be
exploited by malicious people to bypass certain security restrictions
and potentially disclose certain sensitive information.

The vulnerability is caused due to an error within the parsing of the
parameters passed by the URI handler. This can be exploited to inject
a malicious "/Datapath" argument pointing to e.g. a malicious remote
SMB share, which can be leveraged to e.g. control certain Skype
settings (e.g. security policy or proxy settings) and gain access to
sensitive information (e.g. chat logs and call history).

Successful exploitation requires that a Skype user is tricked into
clicking a specially crafted "skype:" URI and may also depend on the
browser being used. Internet Explorer 6, 7, or 8 and Chrome are
reported as possible vectors.

The vulnerability is reported in all versions prior to version
4.2.0.1.55 (v4.2 hotfix #1) for Windows.

SOLUTION:
Update to version 4.2.0.1.55 (v4.2 hotfix #1).

PROVIDED AND/OR DISCOVERED BY:
Paul Craig, Security-Assessment.com Ltd.

ORIGINAL ADVISORY:
Security-Assessment.com Ltd:
http://www.security-assessment.com/files/advisories/Skype_URI_Handling_Vulnerability.pdf

Skype Release notes:
https://developer.skype.com/WindowsSkype/ReleaseNotes
http://share.skype.com/sites/garage/2010/03/10/ReleaseNotes_4.2.0.155.pdf

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------