PT-2012-3593 · Microsoft · Lync+2

Hamburgers Maccoy · Publicado 2012-06-12 · Atualizado 2018-10-12 · CVE-2012-1849

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Lync versions 2010 Microsoft Lync Attendee version 2010 Microsoft Lync Attendant version 2010

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. This can be demonstrated by a directory that contains a .ocsmeet file.

Recommendations For Microsoft Lync 2010, consider restricting access to untrusted directories to minimize the risk of exploitation. For Microsoft Lync Attendee 2010, avoid using untrusted search paths until the issue is resolved. For Microsoft Lync Attendant 2010, as a temporary workaround, consider disabling the loading of DLLs from the current working directory until a patch is available.

Correção

Identificadores relacionados

CVE-2012-1849

Produtos afetados

Lync

Lync Attendant

Lync Attendee

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-1849 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA12-164A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14874 · Nota