Skype Extras Manager (skypePM.exe) skype-plugin: URI Arbitrary XML File Deletion (credentialed check)

medium Nessus Plugin ID 50598

Language:

Synopsis

The remote Skype client allows deletion of arbitrary XML files.

Description

According to its timestamp, the version of Skype installed on the remote host likely includes a version of the Skype Extras Manager (skypePM.exe) that has a flaw in its handling of the 'skype-plugin:' protocol.

If an attacker can trick a user on the affected system into clicking on a specially crafted link, arbitrary '.xml' files on the affected system could be deleted, subject to the user's privileges.

Solution

Upgrade to Skype 4.2.0.169 or later as that is reported to address the issue.

Plugin Details

Severity: Medium

ID: 50598

File Name: skype_4_2_0_169_creds.nasl

Version: 1.10

Type: local

Agent: windows

Family: Windows

Published: 11/15/2010

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/a:skype:skype

Required KB Items: SMB/Registry/Enumerated

Exploit Ease: No known exploits are available

Patch Publication Date: 5/20/2010

Vulnerability Publication Date: 3/11/2010

Reference Information

BID: 38667

Secunia: 38875

Detections

Analytics