Insecure DLL loading in Skype - CVE-2017-6517
Published: March 23, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU39387
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-6517
CWE-ID: CWE-427
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Skype
Skype
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge.The specific flaw exists within the handling of DLL (api-ms-win-core-winrt-string-l1-1-0.dll) loading by the Skype.exe process.
How to mitigate CVE-2017-6517
Install update from vendor's website.
Sources
- http://packetstormsecurity.com/files/141650/Skype-7.16.0.102-DLL-Hijacking.html
- http://seclists.org/fulldisclosure/2017/Mar/44
- http://www.securityfocus.com/bid/96969
- http://www.securitytracker.com/id/1038209
- https://technet.microsoft.com/security/cc308575.aspx
- https://twitter.com/tiger_tigerboy/status/755332687141883904
- https://twitter.com/vysecurity/status/845013670103003138