Skype for Business Emoji DoS Vulnerability
A vulnerability has been identified in the Skype for Business instant messaging client. An attacker can exploit this vulnerability to cause a denial-of-service attack, known as "Kitten of Doom".
This content has been archived
This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk
Summary
A vulnerability has been identified in the Skype for Business instant messaging client. An attacker can exploit this vulnerability to cause a denial-of-service attack, known as "Kitten of Doom".
Threat details
Researchers discovered that the performance of the client degrades after a user receives one hundred emojis from a single sender. They also discovered that when a user receives eight hundred emojis, the client will stop responding. If a user continues to receive emojis after this point, the client will be unusable until the influx of emojis ceases.
An attacker could invite a user to join a meeting via Skype, or contact them directly, and send them hundreds of emojis until the service is rendered useless. Services would not resume until the attacker stopped sending emojis.
For further information:
Remediation steps
| Type | Step |
|---|---|
|
Users and administrators are encouraged to review Microsoft's November 2018 Security Update Summary and apply the necessary updates. |
Last edited: 17 February 2020 12:58 pm