Asterisk & Skype security vulnerabilities

Interesting mp3 podcast by Dan York there, as found on  Blue Box #82: Asterisk & Skype security vulnerabilities.

Skype-SB-2008-003 – Skype File URI Security Bypass Code Execution Vulnerability

" Remote exploitation of a security policy bypass in Windows Skype             versions                 could allow an attacker to execute arbitrary code.                

URI handler in Skype performs checks upon the URL to verify                 that the link does not contain certain file extensions related to                 executable file formats. If the link is found to contain a blacklisted                 executable file extension a security warning dialog is shown to the                 user. This check is flawed in two ways. The check is performed using                 the case sensitive comparison.

               

The second flaw in this check is that the blacklist fails to mention             all                 potential executable file formats. This allows an attacker to bypass                 this security policy and execute arbitrary code if a victim clicks an                 attacker supplied URL.