CVE-2006-2312: Code Injection
Argument injection vulnerability in the URI handler in Skype 2.0..104 and 2.5..0 through 2.5..78 for Windows allows remote authorized attackers to download arbitrary files via a URL that contains certain command-line switches.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2312?
CVE-2006-2312 is considered a high severity vulnerability due to the potential for remote file downloads by unauthorized attackers.
How do I fix CVE-2006-2312?
To fix CVE-2006-2312, users should upgrade to the latest version of Skype that is not affected by this vulnerability.
Which versions of Skype are affected by CVE-2006-2312?
CVE-2006-2312 affects Skype versions 2.0.*.104 and 2.5.*.0 through 2.5.*.78.
What type of attack does CVE-2006-2312 enable?
CVE-2006-2312 enables remote authorized attackers to inject arguments via a specially crafted URL, leading to arbitrary file downloads.
Are there any mitigations for CVE-2006-2312?
Mitigations for CVE-2006-2312 include monitoring incoming links and avoiding the use of legacy Skype versions that are known to be vulnerable.