Microsoft Skype 6.2.0.106 Click to Call Service c2c_service.exe privileges management

Summaryinfo

A vulnerability described as critical has been identified in Microsoft Skype 6.2.0.106. This issue affects some unknown processing of the file c2c_service.exe of the component Click to Call Service. The manipulation results in privileges management. Furthermore, there is an exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Microsoft Skype 6.2.0.106 (Unified Communication Software). It has been classified as critical. Affected is an unknown code block of the file c2c_service.exe of the component Click to Call Service. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The bug was discovered 12/10/2012. The weakness was shared 03/15/2013 by Oliver-Tobias Ripka as confirmed mailinglist post (Bugtraq). The advisory is available at seclists.org. The vendor cooperated in the coordination of the public release. The exploitability is told to be easy. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The exploit is shared for download at packetstormsecurity.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 63 days. During that time the estimated underground price was around $25k-$100k.

Upgrading to version 6.3.59.105 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at OSVDB (91459†) and SecurityTracker (ID 1028297†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Unified Communication Software

Vendor

• Microsoft

Name

• Skype

Version

• 6.2.0.106

License

• free

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion