Skype glitch leaves some users at risk from video bug

Some Skype users were left vulnerable to a possible worm attack Wednesday after company technicians failed to disable a buggy component of the network.
Skype pulled the plug on its "Add Video to Chat" feature Tuesday after security researcher Aviv Raff reported that it suffered from a serious vulnerability. An attacker could create a self-copying worm program that could be used to install malicious software on victims' machines and then go on to infect other Skype users.

"Add Video to Chat" lets users pick videos from two sites -- Dailymotion.com and Metacafe.com -- and add them to their Skype chat sessions.

Skype blocked access to these sites Tuesday after Raff's disclosure, effectively disabling the feature.

But because of a misconfigured Skype proxy server, some users were still allowed to access the Metacafe videos, leaving them vulnerable to an attack, said Raff, who had been in discussions with Skype engineering staff over this issue.

Because Raff has not publicly released his exploit code, the oversight probably doesn't pose a serious security risk for most Skype users, Raff noted.

Skype expects to patch the underlying vulnerability sometime next week, said a spokeswoman for Metacafe. That's later than previously expected. On Tuesday, Metacafe said that a patch was due early Wednesday morning.

Metacafe believes it's unlikely that an attacker could successfully exploit the flaw in a widespread attack, but with Raff's proof of concept code, a Skype user has to simply click on a maliciously crafted Web link in order to be infected.

According to Raff, Skype uses a Windows Internet Explorer (IE) component with an inappropriate security setting. Instead of rendering HTML from the Internet with the more secure "Internet Zone" security setting, Skype uses IE's "Local Zone" security setting, usually reserved for more trustworthy content.

Skype representatives did not return calls seeking comment for this story.