Detections
Analytics
Skype Extras Manager (skypePM.exe) skype-plugin: URI Arbitrary XML File Deletion (uncredentialed check)
medium Nessus Plugin ID 50597
Language:
Synopsis
The remote Skype client allows deletion of arbitrary XML files.Description
According to its timestamp, the version of Skype installed on the remote host likely includes a version of the Skype Extras Manager (skypePM.exe) that has a flaw in its handling of the 'skype-plugin:' protocol.If an attacker can trick a user on the affected system into clicking on a specially crafted link, an arbitrary '.xml' file could be deleted on the affected system subject to the user's privileges.
Solution
Upgrade to Skype 4.2.0.169 or later as that is reported to address the issue.See Also
Plugin Details
Severity: Medium
ID: 50597
File Name: skype_4_2_0_169.nasl
Version: 1.10
Type: remote
Agent: windows
Family: Windows
Published: 11/15/2010
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:skype:skype
Required KB Items: Services/skype
Exploit Ease: No known exploits are available
Patch Publication Date: 5/20/2010
Vulnerability Publication Date: 3/11/2010
Reference Information
BID: 38667
SECUNIA: 38875