SB2018021506 - Privilege escalation in Microsoft Skype

Description

This security bulletin contains information about 1 security vulnerability.

1) Privilege escalation (CVE-ID: N/A)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to insecure .dll loading mechanism when opening files. A local attacker can place a file along with specially crafted DLL in the '[SystemRoot]\Temp\' directory, and execute arbitrary code with system privileges when the Skype update mechanism ('[ProgramFiles]\Skype\Updater\Updater.exe') runs.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References