Popular VoIP application vulnerable to buffer overflow attacks
vnunet.com, 26 Oct 2005
Skype has patched three security holes in its software, rated 'highly critical' by vulnerability testing organisation Secunia.
The flaws include a buffer overflow that could be used to direct users to a specially crafted URL, a flaw in the handling of VCARD information that could allow a system takeover, and a heap-based buffer overflow that could be used to crash the VoIP application.
British security testing specialist Pentest said that the flaws took a week to fix. Its researchers found the flaws on 18 October and reported it to Skype, which released an upgrade last night.
The flaws affect all versions of Skype prior to version 1.4.83 and affect the Windows, Linux, Mac and Pocket PC platform code.
The patched version of Skype is available for download here.
Fast fix for internet telephony system after buffer overflow warning
Almost half of all internet telephony goes to the London-based startup
Recent Swedish attacks raise worrying possibility
Do you agree?
Have your say on this article