full-disclosure - Skype security advisory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu Oct 27 16:02:35 2005
From: dcrstic.ccr at eads.net (. EADS CCR DCR/STI/C)
Subject: Skype security advisory

On Wed, 26 Oct 2005, Brown, Bobby (US - Hermitage) wrote:

> I have the question, can the exploit be perform with no interaction of
> the user other than having the program running waiting for a connection
> or is it only valid after a user accepted a connection and then the flaw
> is exploited?

You don't need any user interaction. It works like any heap overflow (and 
even better because you can directly overwrite some function's pointers
without needing help from the heap management (unlink and friends)).

Because a single UDP packet can exploit the flaw, source can be spoofed 
and doesn't even have to be an IP/port the client has already spoken to.