PT-2013-3060 · Microsoft · Lync 2010+3

Publicado 2013-05-15 · Atualizado 2018-10-12 · CVE-2013-1302

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lync Server 2013 Lync 2010 Lync 2010 Attendee Microsoft Communicator 2007 R2

Description The issue arises from improper handling of objects in memory, allowing remote attackers to execute arbitrary code. This can be achieved by sending an invitation that triggers access to a deleted object.

Recommendations For Microsoft Communicator 2007 R2, update to a version that properly handles objects in memory. For Lync 2010, update to a version that properly handles objects in memory. For Lync 2010 Attendee, update to a version that properly handles objects in memory. For Lync Server 2013, update to a version that properly handles objects in memory.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2013-1302

Produtos afetados

Lync 2010

Lync 2010 Attendee

Lync Server 2013

Communicator 2007 R2

Referências · 4

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1302 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041 · Aviso do Fabricante
• http://us-cert.gov/ncas/alerts/TA13-134A · Nota