Skype security flaw 'ignored' by Microsoft could allow hackers to gain access to users' computers

A fix will instead land in a newer version of the product rather than a dedicated security update

A security bug has been uncovered in Skype via its update process which could allow hackers to gain access to a user's computer.

If exploited by an attacker, the flaw could give a local unprivileged user full access to the system level rights, a security expert over at Seclists.org has warned, giving access to every part of the operating system.

"Once installed, Skype uses its own proprietary update mechanism instead of Windows/Microsoft Update," said security researcher Stefan Kanthak. "[Because] Skype periodically runs '%ProgramFiles%\Skype\Updater\Updater.exe' under the SYSTEM account, when an update is available, [the] Updater.exe copies/extracts another executable as '%SystemRoot%\Temp\SKY

Kanthak explains that its this executable is vulnerable to DLL hijacking as it loads at least a DLL file called 'UXTheme.dll' from its application directory named '%SystemRoot%\Temp\' instead of from the Windows' system directory.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"An unprivileged (local) user who is able to place UXTheme.dll or any of the other DLLs loaded by the vulnerable executable in '%SystemRoot%\Temp\' gains escalation of privilege to the SYSTEM account," he added.

While Microsoft, who owns the video-calling service, has published plenty advice and guidance on how to avoid this error, Kanthak says the tech giant's own developers seem to be "ignoring it".

The security expert informed Microsoft of the bug in September, but according to the Seclists' reported timeline of the bug, a fix will instead land in a newer version of the product rather than a dedicated security update.

"The [Microsoft] engineers provided me with an update on this case," he said. "They've reviewed the code and were able to reproduce the issue, but have determined that the fix will be implemented in a newer version of the product rather than a security update.

"The team is planning on shipping a newer version of the client, and this current version will slowly be deprecated," he added. "The installer would need a large code revision to prevent DLL injection, but all resources have been put toward development of the new client."

With no further action made by Microsoft since, Kanthak published the report on Friday as a warning to Skype users.

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/security/34616/the-top-ten-password-cracking-techniques-used-by-hackers
Security

The top ten password-cracking techniques used by hackers

10 Feb 2020
Visit/operating-systems/microsoft-windows/354739/windows-7-bug-blocks-users-from-shutting-down-their-pcs
Microsoft Windows

Windows 7 bug blocks users from shutting down their PCs

10 Feb 2020
Visit/hardware/354723/coronavirus-starts-to-take-its-toll-on-the-tech-industry
Hardware

Coronavirus starts to take its toll on the tech industry

6 Feb 2020