Updated February 15, 2018: Microsoft has provided an update on this issue, stating that it was corrected in a new version of the Skype installer made available in October. "There was an issue with an older version of the Skype for Windows desktop installer – version 7.40 and lower," Microsoft says. "The issue was in the program that installs the Skype software – the issue was not in the Skype software itself. Customers who have already installed this version of Skype for Windows desktop are not affected. We have removed this older version of Skype for Windows desktop from our website skype.com." The original story follows.
A bug has been found in Skype's update process which could give an attacker system-level privileges if exploited. However, it appears that Microsoft won't be fixing the bug any time soon.
ZDNet reports that Microsoft is aware of the bug, but says that it requires "too much work" for an immediate security fix. From ZDNet:
But Microsoft, which owns the voice- and video-calling service, said it won't immediately fix the flaw, because the bug would require too much work.
Stefan Kanthak, the security researcher who discovered and described the bug, explained that the issue lies in Skype's updater, which runs as a separate executable file. The executable is vulnerable to DLL hijacking, which could be used to trick the application into loading malicious code. An attacker could use this vector to gain system privileges, which would allow them to "do anything," Kanthak told ZDNet.
Microsoft was alerted to the vulnerability in September, but it says it "would need a large code revision to prevent DLL injection." Rather than issue a security update, Microsoft says instead that a fix will be released with a newer version of the client while the current version "will slowly be deprecated."
It's worth noting that this only applies to the desktop Skype app and not the Universal Windows Platform (UWP) version available from the Microsoft Store.
We may earn a commission for purchases using our links. Learn more.
Review: EufyCam 2 Kit is the best home-security setup with no fees
If you're looking for a sound home security camera system, Eufy is your best bet. All your video data is kept local, with no cloud storage, and there are no subscriptions whatsoever. Combined with excellent features, low-light ability, and a battery that lasts a year, Eufy is way better than Ring. Here's why.
These are the best laptops HP has to offer
The Spectre x360 13t is currently the best HP laptop you can buy thanks to a potent blend of performance and design. However, there are plenty more options that come close to taking the top spot.
Microsoft's upcoming Surface Pro 8 and Surface Laptop 4 images leak
Microsoft is expected to launch new versions of its Surface Pro and Surface Laptop early next year, and today images of those products have appeared online as they pass through certification in Korea. These images confirm that the devices won't be featuring any new designs, instead opting to keep the external chassis' the same as the previous generation.
Make the most of your Surface Pen and Slim Pen with these awesome apps
To really maximize the ability of the Surface Pen and Slim Pen, there are some essential apps you should check out. We've rounded up the best right here for a variety of purposes.