Full Disclosure mailing list archives
RE: Skype security advisory
From: . EADS CCR DCR/STI/C <dcrstic.ccr () eads net>
Date: Thu, 27 Oct 2005 15:55:28 +0200
On Wed, 26 Oct 2005, Brown, Bobby (US - Hermitage) wrote:
I have the question, can the exploit be perform with no interaction of the user other than having the program running waiting for a connection or is it only valid after a user accepted a connection and then the flaw is exploited?
You don't need any user interaction. It works like any heap overflow (and even better because you can directly overwrite some function's pointers without needing help from the heap management (unlink and friends)). Because a single UDP packet can exploit the flaw, source can be spoofed and doesn't even have to be an IP/port the client has already spoken to. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Skype security advisory . EADS CCR DCR/STI/C (Oct 25)
- <Possible follow-ups>
- RE: Skype security advisory Brown, Bobby (US - Hermitage) (Oct 26)
- Re: Skype security advisory sk (Oct 26)
- RE: Skype security advisory . EADS CCR DCR/STI/C (Oct 27)