Home

Update: Skype says it issued a hotfix on April 14, 2011 to address this issue, the company just didn’t prompt users to download the fix.

Mac users may want to be extra careful when using Skype, thanks to a nasty zero-day vulnerability in the Mac OS X version of the client.

Security researcher Gordon Maddern from the firm Pure Hacking discovered a flaw in Skype that allows a skilled individual to gain remote access to another’s machine simply by sending a Skype message.

UPDATE: Skype has issued a patch for the vulnerability but hasn’t pushed it out to users. To get the updated, patched software, download Skype 5.1.0.992.

Maddern says the discovered the hole by accident but put together a proof of concept showing how potentially dangerous it could be. By simply sending a message, Maddern was able to take control of a user’s computer and execute a shell instance. Scary stuff.

The researcher contacted Skype more than a month ago, but despite assurances from Skype that a fix was on the way, the program has remained unpatched.

In fact, it appears that it was only after Maddern blogged about the issue — and others like ZDNet UK championed the cause — that Skype felt the need to see the issue as a major problem.

Read more...