Fresh from the oven, a Zero Day of Skype has been published, affecting the version on the Windows XP, Vista, 7 platform. This failure implies that a user with bad intentions can define a malicious code in some of its fields, and when reading this information, the victim’s application will interpret it.

To check the veracity of this failure, you can include the following code in the different sections, and as you can see, the application itself recognizes the tags that the malicious user has inserted.

Home Phone Number: INJECTION HERE

Office Phone Number: INJECTION HERE

Mobile Phone Number: INJECTION HERE

 

From here it is in the hands of the attacker’s imagination. This information is published with the intention for the end user to be cautious and take appropriate measures, given that Skype has not yet resolved this problem.

The advisor’s note has been published in:

http://www.noptrix.net/advisories/skype_inject.txt