"Kevin Beaumont" <kevin.beaum...@gmail.com> wrote: >I did a fresh install of Win7 Home yesterday and can confirm impacted Skype > version was offered by Windows Update for install.
Thanks for the confirmation. See <https://skanthak.homepage.t-online.de/skype.html> for my writeup of Skype's and Microsoft's epic failures in this case, including my reply to the false statements of Microsoft's Ellen Kilbourne. Stefan > On Tue, 20 Feb 2018 at 18:31, Stefan Kanthak <stefan.kant...@nexgo.de> > wrote: > >> "Jeffrey Walton" <noloa...@gmail.com> wrote: >> >> > On Fri, Feb 9, 2018 at 1:01 PM, Stefan Kanthak <stefan.kant...@nexgo.de> >> wrote: >> >> [ http://seclists.org/fulldisclosure/2018/Feb/33 ] >> >> > Not sure if this is related, but: >> > >> https://winbuzzer.com/2018/02/14/microsoft-just-killed-skype-classic-response-unfixable-security-bug-xcxwbn/ >> >> This is of course related: after Zack Whittacker published >> < >> https://www.zdnet.com/article/skype-cannot-fix-security-bug-without-a-massive-code-rewrite/ >> > >> some hundred news outlets, bloggers etc. followed up. >> Except Zack Whittacker nobody contacted me. >> Many copied his article, some others added their own and wrong >> interpretation, even pure fiction, like this "WinBuzz": >> >> | Microsoft today squashed a bug that was found in Skype's updater >> | process earlier this week. >> >> Wrong. I reported the vulnerability 5 months ago. >> And Microsoft WONTFIX this vulnerability in Skype 7.x >> >> JFTR: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5720> >> also WONTFIX >> >> [ pure speculation removed ] >> >> | It seems Microsoft found an alternative to rewriting code and fixing >> | Skype. the company has decided to effectively kill off the classic >> | app. The older version of Skype is no longer available anywhere as a >> | download. >> >> Really? >> >> Microsoft Update still offers the "classic" Skype for Windows alias >> Skype Desktop Client: on Windows 7 (which still has the largest >> market share) open Windows' control panel, go to Windows Update, >> switch to Microsoft Update (if not done before), and find KB2876229 >> "Skype for Windows (7.30.0.101)" beyond the optional updates. >> >> For those who don't want to or can not start Microsoft Update: >> the Microsoft Update Catalog offers this and two older versions too >> <https://www.catalog.update.microsoft.com/search.aspx?q=kb2876229> >> >> >> In <https://support.microsoft.com/en-us/kb/2876229> Microsoft states: >> >> | Skype releases new versions of Skype for Windows throughout the year. >> | To help you stay current with new functionality| and features of the >> | Skype experience, Skype is available through Microsoft Update. >> ... >> | you will receive the latest version of Skype through Microsoft Update. >> >> NO, you DON'T get the latest version of Skype there! >> And Skype doesn't use Microsoft Update to deliver updates. >> Microsoft had well over 100 days since they closed MSRC case 40550 to >> fix this ... >> >> >> stay tuned >> Stefan Kanthak _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
