CVE-2011-1717: SQL Injection
First published: Mon Apr 18 2011(Updated: )
Skype for Android stores sensitive user data without encryption in sqlite3 databases that have weak permissions, which allows local applications to read user IDs, contacts, phone numbers, date of birth, instant message logs, and other private information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Skype for Android |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://blogs.skype.com/security/2011/04/privacy_vulnerability_in_skype.html
- http://www.androidpolice.com/2011/04/14/exclusive-vulnerability-in-skype-for-android-is-exposing-your-name-phone-number-chat-logs-and-a-lot-more/
- http://www.theregister.co.uk/2011/04/15/skype_for_android_vulnerable/
- http://www.securitytracker.com/id?1025387
Frequently Asked Questions
What is the severity of CVE-2011-1717?
CVE-2011-1717 is considered a high severity vulnerability due to improper handling of sensitive user data.
How do I fix CVE-2011-1717?
To fix CVE-2011-1717, update Skype for Android to the latest version where the vulnerability has been addressed.
What types of data are exposed in CVE-2011-1717?
CVE-2011-1717 exposes sensitive user data such as user IDs, contacts, phone numbers, and instant message logs.
Who is affected by CVE-2011-1717?
Users of Skype for Android are affected by CVE-2011-1717 due to the lack of data encryption.
Is there a workaround for CVE-2011-1717?
There is no effective workaround for CVE-2011-1717 other than updating to the patched version of Skype for Android.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/skype
- canonical/skype for android