Skype IM Client Password Disclosure Vulnerability.
Skype 3.8 / Previous version can be affected.
11 September 2008
The skype client inherits client side password disclosure vulnerability.
The credentials used to connect to
the required service i.e. username and password is not encrypted
properly. The credentials can be extracted
in clear text by dumping process memory of the live pidgin process when
a connection is set. The vulnerability
allows anyone with access to the client system to obtain the username
and password. Additionally, this
vulnerability could also be exploited by fooling the user to execute
malicious code which would dump the
memory of the process "skype.exe". The skype uses skype.exe and
skypepm.exe processes while communicating.
The skype.exe dumps password in clear text.
Proof of Concept: