Microsoft fixed serious Skype installer security flaw in October [Updated]
The thorny bug previously present in Skype's installer could give an attacker system-level access.
Updated February 15, 2018: Microsoft has provided an update on this issue, stating that it was corrected in a new version of the Skype installer made available in October. "There was an issue with an older version of the Skype for Windows desktop installer – version 7.40 and lower," Microsoft says. "The issue was in the program that installs the Skype software – the issue was not in the Skype software itself. Customers who have already installed this version of Skype for Windows desktop are not affected. We have removed this older version of Skype for Windows desktop from our website skype.com." The original story follows.
A bug has been found in Skype's update process which could give an attacker system-level privileges if exploited. However, it appears that Microsoft won't be fixing the bug any time soon.
ZDNet reports that Microsoft is aware of the bug, but says that it requires "too much work" for an immediate security fix. From ZDNet:
Stefan Kanthak, the security researcher who discovered and described the bug, explained that the issue lies in Skype's updater, which runs as a separate executable file. The executable is vulnerable to DLL hijacking, which could be used to trick the application into loading malicious code. An attacker could use this vector to gain system privileges, which would allow them to "do anything," Kanthak told ZDNet.
Microsoft was alerted to the vulnerability in September, but it says it "would need a large code revision to prevent DLL injection." Rather than issue a security update, Microsoft says instead that a fix will be released with a newer version of the client while the current version "will slowly be deprecated."
It's worth noting that this only applies to the desktop Skype app and not the Universal Windows Platform (UWP) version available from the Microsoft Store.
Get the Windows Central Newsletter
All the latest news, reviews, and guides for Windows and Xbox diehards.
Dan Thorp-Lancaster is the former Editor-in-Chief of Windows Central. He began working with Windows Central, Android Central, and iMore as a news writer in 2014 and is obsessed with tech of all sorts. You can follow Dan on Twitter @DthorpL and Instagram @heyitsdtl.