Skype XSS hole is harmless

Powered by SC Magazine
 

Exploit resembled another Skype attack.

Microsoft has squashed a claim by a German security researcher that Skype is vulnerable to cross site scripting (XSS) attacks.

The company said the exploit posted online in an advisory was benign.

Levent Kayan said the Skype client contained a persistent code injection vulnerability caused by a lack of input validation and output sanitisation of phone contact entry fields.

Kayan said it would allow an attacker to inject HTML or Javascript code into fields that were meant to contain names and phone numbers.

 

 

Skype said the attack was impossible because the vulnerable entry fields were not internet-accessible windows.

The vulnerability had credibility because Kayne last month released details of a similar high-profile exploit of the Skype client.

That attack allowed Skype contacts to be hijacked with a string of code injected into the mobile phone entry field. An attacker could run script on the victim’s machine and obtain their session ID and account details.

The flaw was fixed.

Copyright © SC Magazine, Australia


Skype XSS hole is harmless
 
 
 
Top Stories
Brandis hits telcos with new security reforms
Civil penalties for those who don't comply.
 
When does an insurance company turn into a software vendor?
The lines are blurring for ASX-listed Cover-More Group.
 
APIs: rivets for the composable enterprise
Expanding a savvy CIO's toolbox.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
New Microsoft Office apps for Android phones
Jun 26, 2015
Microsoft's latest Office apps for Android now work on phones as well as tablets, further ...
Windows 10 UK price revealed, but don't believe everything you hear
Jun 26, 2015
Windows 10 £99 price tag for users in the UK (who presumably don't already have Win 7 Pro ...
Now Xero notifies iOS users of new transactions
Jun 24, 2015
The latest version of Xero's iPhone app includes notifications when new transactions arrive from ...
Your Essential Cloud Toolbox
Jun 22, 2015
When BIT interviewed Receipt Bank country manager Sophie Hossack, we asked for her thoughts on ...
Toshiba laptops to get “Cortana button” ahead of Windows 10 launch
Jun 19, 2015
Toshiba introduces 12 new laptops, all aimed at getting the most out of Microsoft's digital ...
Latest Comments
Polls
Is site blocking effective in stopping piracy?


   |   View results
Yes
  2%
 
No
  86%
 
Somewhat
  12%
TOTAL VOTES: 463

Vote