“About a month ago I was chatting on skype to a colleague about a payload for one of our clients,” he wrote. “Completely by accident, my payload executed in my colleagues skype client.
That means this thing is either BS or it is an egregious bug by the Skype team. Remote code execution doesn't happen by chance.
"Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail.
...
A large number of Exim installations exist, especially within Internet service providers[1] and universities in the UK. Exim is also widely used with the GNU Mailman mailing list manager, and cPanel."
Not if skype renders javascript somehow. Amazon had a similar vulnerability in the "preview this book" feature a few months ago. If you used it to preview certain books that had example XSS payloads, you would get owned.
What does XSS have to do with remote code execution? I mean, it's possible for a Javascript parser to have vulnerabilities that can lead to arbitrary code execution, but the Amazon example seems in no way relevant here.
Well, it's a Register article. I left open the possibility that they called "remote script execution" remote code execution. They already said it gains root access, but then later said it gives shell access, which is not the same thing (since skype does not run as root).
I have no idea what the bug is, all I meant was that it wasn't completely out of the realm of possibility to have something render a payload.
The original builds of Android for the G1 had a root terminal running in the background that used keyboard input even though it was invisible and not focused. This allowed you, eg, run telnetd and then connect from your PC to run commands as root, which included the ability to re-flash the bootloader and jailbreak the OS.
That means this thing is either BS or it is an egregious bug by the Skype team. Remote code execution doesn't happen by chance.