CVE-2008-2545
UnknownEPSS 4.23%
Last modified
CVE-2008-2545 is a vulnerability of currently unknown severity. Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension that uses a different case.. EPSS estimates a 4.23% chance of exploitation in the next 30 days.
Description
Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension that uses a different case.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Skype Technologies | Skype | <= 3.8.0.115 | — |
| Skype Technologies | Skype | 3.0.0.106 | Beta |
| Skype Technologies | Skype | 3.0.0.123 | Beta |
| Skype Technologies | Skype | 3.0.0.137 | Beta |
| Skype Technologies | Skype | 3.0.0.154 | Beta |
| Skype Technologies | Skype | 3.0.0.190 | — |
| Skype Technologies | Skype | 3.0.0.198 | — |
| Skype Technologies | Skype | 3.0.0.205 | — |
| Skype Technologies | Skype | 3.0.0.209 | — |
| Skype Technologies | Skype | 3.0.0.214 | — |
| Skype Technologies | Skype | 3.0.0.216 | — |
| Skype Technologies | Skype | 3.0.0.217 | — |
| Skype Technologies | Skype | 3.0.0.218 | — |
| Skype Technologies | Skype | 3.1.0.112 | Beta |
| Skype Technologies | Skype | 3.1.0.134 | Beta |
| Skype Technologies | Skype | 3.1.0.144 | — |
| Skype Technologies | Skype | 3.1.0.147 | — |
| Skype Technologies | Skype | 3.1.0.150 | — |
| Skype Technologies | Skype | 3.1.0.152 | — |
| Skype Technologies | Skype | 3.2.0.53 | Beta |
| Skype Technologies | Skype | 3.2.0.63 | Beta |
| Skype Technologies | Skype | 3.2.0.82 | Beta |
| Skype Technologies | Skype | 3.2.0.115 | Beta |
| Skype Technologies | Skype | 3.2.0.145 | — |
| Skype Technologies | Skype | 3.2.0.148 | — |
| Skype Technologies | Skype | 3.2.0.152 | — |
| Skype Technologies | Skype | 3.2.0.158 | — |
| Skype Technologies | Skype | 3.2.0.163 | — |
| Skype Technologies | Skype | 3.2.0.175 | — |
| Skype Technologies | Skype | 3.5.0.107 | Beta |
| Skype Technologies | Skype | 3.5.0.158 | Beta |
| Skype Technologies | Skype | 3.5.0.178 | Beta |
| Skype Technologies | Skype | 3.5.0.202 | — |
| Skype Technologies | Skype | 3.5.0.214 | — |
| Skype Technologies | Skype | 3.5.0.229 | — |
| Skype Technologies | Skype | 3.5.0.234 | — |
| Skype Technologies | Skype | 3.5.0.239 | — |
| Skype Technologies | Skype | 3.6.0.127 | Beta |
| Skype Technologies | Skype | 3.6.0.159 | Beta |
| Skype Technologies | Skype | 3.6.0.216 | — |
| Skype Technologies | Skype | 3.6.0.244 | — |
| Skype Technologies | Skype | 3.6.0.248 | — |
| Skype Technologies | Skype | 3.8.0.96 | Beta |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2008-2545?
Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension that uses a different case.
How severe is CVE-2008-2545?
Severity scoring for CVE-2008-2545 is pending analysis. The EPSS model estimates a 4.23% probability of exploitation in the next 30 days.
How do I fix CVE-2008-2545?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2008
- CVE-2008-2539The Sun Cluster Global File System in Sun Cluster 3.1 on Sun…
- CVE-2008-2540Apple Safari on Mac OS X, and before 3.1.2 on Windows, does …
- CVE-2008-2541Multiple stack-based buffer overflows in the HTTP Gateway Se…
- CVE-2008-2542Stack-based buffer overflow in the getline function in Ppm/p…
- CVE-2008-2543The ooh323 channel driver in Asterisk Addons 1.2.x before 1.…
- CVE-2008-2544Mounting /proc filesystem via chroot command silently mounts…5.5
- CVE-2008-2546Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2008-2547Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and…
- CVE-2008-2548Stack-based buffer overflow in the JPEG thumbprint component…
- CVE-2008-2549Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, al…
- CVE-2008-2550Unspecified vulnerability in the Web Services Security compo…
- CVE-2008-2551The DownloaderActiveX Control (DownloaderActiveX.ocx) in Ico…
Are you affected by CVE-2008-2545?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST