Skype quick to fix buffer overflow flaw in VoIP application

Posted on 16 Nov 2004 at 10:29

Update released for Internet telephony and instant messaging software

Skype has moved quickly to fix a 'highky critical flaw' in its eponymous and phenomenally popular Internet telephony (VoIP) and instant messaging software.

The 'callto:' URI handler buffer overflow vulnerability in versions 1.0.*.95 to 1.0.*.98. of Skype for Windows is caused due by boundary error within the handling of command line arguments. This can be exploited to cause a stack-based buffer overflow by, for example, tricking a user into visiting a malicious website, which passes an overly long string (more than 4096 bytes) to the 'callto:' URI handler. Successful exploitation may allow execution of arbitrary code.

Users should update to Skype 1.0.0.100, available from www.skype.com.

Skype has been downloaded more than 34 million times since its release earlier this year. Mac OS X, Linux and Pocket PC versions are also available.