Executive brief
A security flaw in the Microsoft Skype installer for Windows allows an attacker with local access to a computer to run malicious code. By placing a specially crafted file in the same folder as the installer, the attacker can trick the application into executing unauthorized commands with the user's privileges. This could lead to a full system compromise or unauthorized access to sensitive personal data.
Technical details
The Microsoft Skype installer for Windows is vulnerable to DLL hijacking (untrusted search path vulnerability). The application attempts to load several system libraries—specifically msi.dll, dpapi.dll, and cryptui.dll—by searching the current working directory before searching secure system directories. A local attacker can place a malicious version of one of these DLLs in the directory from which the installer is launched (such as the Downloads folder). When the installer is executed, it loads the malicious DLL, allowing for arbitrary code execution with the privileges of the user running the installer. Microsoft reportedly declined to issue a formal fix for this specific installer behavior at the time of disclosure.
Affected products
- Microsoft Skype All versions prior to January 2017
Timeline
- 2016-09-27: disclosed: Public disclosure on Full Disclosure mailing list
- 2017-01-23: advisory: NVD published the CVE record