Undocumented Telnetd & Code Execution

A few weeks ago, in the context of a security, we had carried out individual investigations following an anomaly in a private network. Web radio terminals device of the company Telestar Digital GmbH were identified, which have an undocumented telnetd server. Since this seemed strange to us, we took a closer look at the services and other functions and found something amazing.

Microsoft Skype Mobile v8.x - Remote Denial of Service Vulnerability

Vulnerability Labs core team discovered a new denial of service vulnerability and rendering problem in Skype Mobile Client v8.12 and v8.13 this week. The vulnerability can be triggered by sending a special smiley (emoticon) content message remotely. The security problem can be triggered locally and remotely. The problem concerns the mobile client for Android and ios and was demonstrated by ios on Samsung device with a poc video.

The security vulnerability was reported to the microsoft corporation in february (2018-02-03) with MSRC ID 43520 by the vulnerability laboratory core research team.