CVE-2010-3136: Critical severity skype Skype vulnerability
Published Aug 26, 2010
·Updated
Untrusted search path vulnerability in Skype 4.2.0.169 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wab32.dll that is located in the same folder as a .skype file.
Affected Software
151 affected components
skype Skype=3.1.0.134-beta
skype Skype=2.5.0.154
skype Skype=3.8.0.154
skype Skype=0.98.0.6-beta
skype Skype=0.97.0.3-beta
skype Skype=4.2.0.166
skype Skype=3.2.0.145
skype Skype=3.2.0.158
skype Skype=1.2.0.41
skype Skype=4.2.0.158
skype Skype=1.3.0.57
skype Skype=3.8.0.96-beta
skype Skype=3.1.0.144
skype Skype=1.0.0.94
skype Skype=4.0.0.226
skype Skype=0.93.0.18-beta
skype Skype=0.94.0.28-beta
skype Skype=4.0.0.227
skype Skype=0.95.0.11-beta
skype Skype=0.92.0.4-beta
skype Skype=1.0.0.9
skype Skype=1.0.0.97
skype Skype=3.2.0.82-beta
skype Skype=3.6.0.127-beta
skype Skype=1.0.0.18
skype Skype=2.0.0.105
skype Skype=3.0.0.154-beta
skype Skype=1.0.0.29
skype Skype=1.4.0.84
skype Skype=0.98.0.68-beta
skype Skype=2.0.0.81
skype Skype=2.0.0.103
skype Skype=2.0.0.90
skype Skype=1.0.0.106
skype Skype=2.5.0.130
skype Skype=3.1.0.152
skype Skype=3.0.0.106-beta
skype Skype=0.90.0.5-beta
skype Skype=3.5.0.158-beta
skype Skype=4.0.0.166-beta_2
skype Skype=1.4.0.71
skype Skype=3.1.0.112-beta
skype Skype=1.3.0.54
skype Skype=4.0.0.215
skype Skype=3.6.0.248
skype Skype=3.5.0.214
skype Skype=3.2.0.53-beta
skype Skype=0.91.0.2-beta
skype Skype=3.2.0.115-beta
skype Skype=0.96.0.1-beta
skype Skype=1.3.0.48
skype Skype=3.2.0.148
skype Skype=2.0.0.107
skype Skype=1.4.0.78
skype Skype=1.3.0.66
skype Skype=1.0.0.10
skype Skype=3.8.0.115
skype Skype=3.0.0.205
skype Skype=4.0.0.150-beta
skype Skype=1.3.0.51
skype Skype=4.0.0.181-beta_3
skype Skype=1.1.0.79
skype Skype=4.0-beta_3
skype Skype=3.0.0.214
skype Skype=4.2.0.163
skype Skype=0.97.0.6-beta
skype Skype=2.6.0.105-beta
skype Skype=4.0.0.168-beta_2
skype Skype=2.6.0.103-beta
skype Skype=2.5.0.113
skype Skype=0.93.1.1-beta
skype Skype=1.3.0.55
skype Skype=2.6.0.67-beta
skype Skype=3.5.0.239
skype Skype=2.5.0.137
skype Skype=3.0.0.198
skype Skype=2.6.0.97-beta
skype Skype=2.6.0.81-beta
skype Skype=3.0.0.190
skype Skype=2.5.0.82
skype Skype=1.3.0.60
skype Skype=3.2.0.175
skype Skype=2.5.0.122
skype Skype=3.5.0.107-beta
skype Skype=4.2.0.155
skype Skype=3.0.0.216
skype Skype=4.0.0.161-beta
skype Skype=3.6.0.244
skype Skype=4.0.0.176-beta_3
skype Skype=1.2.0.48
skype Skype=3.2.0.63-beta
skype Skype=0.97.0.40-beta
skype Skype=4.1.0.136
skype Skype=2.0.0.97
skype Skype=3.2.0.163
skype Skype=4.2.0.152
skype Skype=3.8.0.144
skype Skype=0.96.0.3-beta
skype Skype=0.97.0.1-beta
skype Skype=3.1.0.150
skype Skype=4.1.0.130-beta
skype Skype=0.94.0.19-beta
skype Skype=3.1.0.147
skype Skype=0.98.0.28-beta
skype Skype=3.0.0.218
skype Skype<=4.2.0.169
skype Skype=4.0.0.224
skype Skype=3.5.0.234
skype Skype=2.5.0.151
skype Skype=1.3.0.45
skype Skype=2.5.0.126
skype Skype=4.1.0.130
skype Skype=3.5.0.229
skype Skype=3.8.0.188
skype Skype=4.1.0.141
skype Skype=4.0.0.206
skype Skype=2.6.0.74-beta
skype Skype=4.1.0.179
skype Skype=3.8.0.180
skype Skype=2.0.0.73
skype Skype=3.0.0.137-beta
skype Skype=4.0.0.145-beta
skype Skype=0.98.0.04-beta
skype Skype=3.2.0.152
skype Skype=4.0.0.155-beta_1
skype Skype=0.95.0.36-beta
skype Skype=0.98.0.42-beta
skype Skype=3.0.0.123-beta
skype Skype=2.5.0.72
skype Skype=3.6.0.216
skype Skype=2.0.0.69
skype Skype=3.8.0.139
skype Skype=3.5.0.178
skype Skype=3.0.0.217
skype Skype=3.6.0.159-beta
skype Skype=2.5.0.141
skype Skype=0.90.0.10-beta
skype Skype=0.95.0.25-beta
skype Skype=1.1.0.73
skype Skype=1.0.0.100
skype Skype=2.0.0.79
skype Skype=2.5.0.91
skype Skype=3.5.0.202
skype Skype=4.0.0.169-beta_2
skype Skype=0.95.0.40-beta
skype Skype=4.0.0.216
skype Skype=4.2.0.141-beta
skype Skype=4.1.0.166
skype Skype=1.2.0.37
skype Skype=1.1.0.6
skype Skype=3.0.0.209
Event History
Aug 26, 2010
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-3136?
CVE-2010-3136 has a moderate severity rating, allowing local and possibly remote attackers to execute arbitrary code through DLL hijacking.
2
How do I fix CVE-2010-3136?
To fix CVE-2010-3136, users should update to a version of Skype that is later than 4.2.0.169.
3
What are the potential impacts of CVE-2010-3136?
The potential impacts of CVE-2010-3136 include unauthorized code execution and potential control over the affected system.
4
Which versions of Skype are affected by CVE-2010-3136?
CVE-2010-3136 affects Skype versions up to and including 4.2.0.169.
5
Who is primarily affected by CVE-2010-3136?
Primarily, local users or adversaries with local access to the system are affected by CVE-2010-3136.