bugtraq - Skype IM Client Password Disclosure Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 17 Sep 2008 18:02:38 +0530
From: Aditya K Sood <0kn0ck@...niche.org>
To: bugtraq@...urityfocus.com
Subject: Skype IM Client Password Disclosure Vulnerability.

Skype IM Client Password Disclosure Vulnerability.

*Version Affected:*
Skype 3.8 / Previous version can be affected.

*Release Date:*
11 September 2008

*Description:*
The skype client inherits client side password disclosure vulnerability. 
The credentials used to connect to
the required service i.e. username and password is not encrypted 
properly. The credentials can be extracted
in clear text by dumping process memory of the live pidgin process when 
a connection is set. The vulnerability
allows anyone with access to the client system to obtain the username 
and password. Additionally, this
vulnerability could also be exploited by fooling the user to execute 
malicious code which would dump the
memory of the process "skype.exe". The skype uses skype.exe and 
skypepm.exe processes while communicating.
The skype.exe dumps password in clear text.
*
Proof of Concept:

**http://evilfingers.com/advisory/skype_pass_dis_vul.pdf
http://secniche.org/advisory/skype_vul.pdf

<cid:part1.09030909.07070102@...niche.org>
Links:
http://secniche.org/advisory.html
http://evilfingers.com/advisory/index.php
*
*Credit:*
Aditya K Sood

*Disclaimer*
The information in the advisory is believed to be accurate at the time 
of publishing based on currently available
information. Use of the information constitutes acceptance for use in an 
AS IS condition. There is no representation
or warranties, either express or implied by or with respect to anything 
in this document, and shall not be liable for
any implied warranties of merchantability or fitness for a particular 
purpose or for any indirect special or consequential damages.