Researchers uncover zero-day flaw in Mac Skype

A security researcher ihas uncovered a new, and potentially serious, security vulnerability in the Skype client for Mac OS X systems.

Gordon Maddern, of security firm PureHacking, said in a blog post that the zero-day flaw could allow an attacker to remotely execute code on a targeted system without user interaction.

The exact nature of the flaw is not being disclosed until Skype is able to release a patch, but Maddern said that the issue was discovered by accident while talking on the service with a friend.

"About a month ago I was chatting on skype to a collegue about a payload for one of our clients," he said. "Completely by accident, my payload executed in my collegue's Skype client."

The researcher investigated the issue and eventually built a proof-of-concept sample to exploit the vulnerability.

"The long and the short of it is that an attacker needs only to send a victim a message and they can gain remote control of the victim's Mac. It is extremely wormable and dangerous," Maddern wrote.

The disclosure follows an eventful week in the Mac OS X security space, after reports of a cyber crime kit spreading among OS X systems.

A few days later, Microsoft alerted users that a security update was on the way to address vulnerabilities in multiple versions of Office for Mac.