PT-2013-4615 · Microsoft+1 · Exchange Server 2007+4

Takahiro Haruyama · Publicado 2013-07-17 · Atualizado 2018-10-12 · CVE-2013-3776

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 8.3.7 through 8.4.1 Exchange Server 2007 Exchange Server 2010 Exchange Server 2013

Description The issue allows attackers to affect availability or execute remote code, depending on the context. For Exchange Server, the vulnerability could allow remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser. The LocalService account has minimum privileges on the local computer and presents anonymous credentials on the network.

Recommendations For Oracle Fusion Middleware versions 8.3.7 through 8.4.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Exchange Server 2007, consider disabling the WebReady Document Viewing feature until a patch is available. For Exchange Server 2010, consider disabling the WebReady Document Viewing feature until a patch is available. For Exchange Server 2013, consider disabling the WebReady Document Viewing feature until a patch is available.

Identificadores relacionados

CVE-2013-3776

Produtos afetados

Exchange Server

Exchange Server 2007

Exchange Server 2010

Exchange Server 2013

Oracle Fusion Middleware

Referências · 14

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3776 · Nota
• http://securityfocus.com/bid/61234 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18243 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms13-061 · Nota
• http://securitytracker.com/id/1028801 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85663 · Nota
• http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000071.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3776 · Nota de Segurança
• http://osvdb.org/95276 · Nota
• http://jvn.jp/en/jp/JVN68663052/index.html · Nota
• http://oracle.com/technetwork/topics/security/cpujuly2013-1899826.html · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21660640 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-061 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3776 · Nota de Segurança