Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

RE: Skype security advisory
From: . EADS CCR DCR/STI/C <dcrstic.ccr () eads net>
Date: Thu, 27 Oct 2005 15:55:28 +0200

On Wed, 26 Oct 2005, Brown, Bobby (US - Hermitage) wrote:

I have the question, can the exploit be perform with no interaction of
the user other than having the program running waiting for a connection
or is it only valid after a user accepted a connection and then the flaw
is exploited?

You don't need any user interaction. It works like any heap overflow (and 
even better because you can directly overwrite some function's pointers
without needing help from the heap management (unlink and friends)).

Because a single UDP packet can exploit the flaw, source can be spoofed 
and doesn't even have to be an IP/port the client has already spoken to.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault