HITB2011KUL - Skype Vulnerabilities 0Day Exploitation

Presentation Title Skype Vulnerabilities: Zero Day Exploitation 2011
Presentation Abstract

The popular VOIP client Skype has been beaten?! As everyone knows Skype takes security very seriously according
to their own words: “The security of your information is of the utmost concern to us here at Skype and something
we take very seriously” So we rose up to the challenge and tried to see if we could beat the system filters and/or
software out of the box.

This presentation will offer the first in depth view & analysis of the bugs that where found in Skype by the
vulnerability-lab.com research team in 2011. The presentation will also provide exclusive attack schemes from
an attackers point of view which were also used for verification of our findings.

Buglist:

– Skype 5.3.x 2.2.x 5.2.x – Persistent Cross Site Scripting Vulnerability
– Skype 5.3.x 2.2.x 5.2.x – Persistent Software Vulnerability
– Skype v5.3.x – Transfer Standby Buffer Overflow Vulnerability
– Skype v5.2.x and v5.3.x – Critical Pointer Vulnerability
– Skype v5.3.x v2.2.x v5.2.x – Denial of Service Vulnerability

Attack schemes:

– Client Side Skype Exploitation (Local & Remote)
– Server Side Exploitation #1 (Local & Remote)
– Server Side Exploitation #2 (Local & Remote)
– Denial of Service Exploitation (Local to Remote)
– Buffer Overflow Exploitation (Remote)
– Pointer Bug Exploitation (Local)

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - HITB2011KUL - Skype Vulnerabilities 0Day Exploitation
id: 48aaccca-c3bd-43d6-9b97-c7e670edae45
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "HITB2011KUL - Skype Vulnerabil" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("HITB2011KUL - Skype Vulnerabilities 0Day")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*HITB2011KUL - Skype Vulnerabilities 0Day*"

CommonSecurityLog
| where Message has "HITB2011KUL - Skype Vulnerabilities 0Day"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc