Skype Extras Manager (skypePM.exe) skype-plugin: URI Arbitrary XML File Deletion (uncredentialed check)

medium Nessus Plugin ID 50597

Language:

Synopsis

The remote Skype client allows deletion of arbitrary XML files.

Description

According to its timestamp, the version of Skype installed on the remote host likely includes a version of the Skype Extras Manager (skypePM.exe) that has a flaw in its handling of the 'skype-plugin:' protocol.

If an attacker can trick a user on the affected system into clicking on a specially crafted link, an arbitrary '.xml' file could be deleted on the affected system subject to the user's privileges.

Solution

Upgrade to Skype 4.2.0.169 or later as that is reported to address the issue.

Plugin Details

Severity: Medium

ID: 50597

File Name: skype_4_2_0_169.nasl

Version: 1.10

Type: remote

Agent: windows

Family: Windows

Published: 11/15/2010

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/a:skype:skype

Required KB Items: Services/skype

Exploit Ease: No known exploits are available

Patch Publication Date: 5/20/2010

Vulnerability Publication Date: 3/11/2010

Reference Information

BID: 38667

SECUNIA: 38875

Detections

Analytics