PT-2013-5796 · Microsoft+1 · Exchange Server 2007+4

Will Dormann · Publicado 2013-10-16 · Atualizado 2018-10-12 · CVE-2013-5791

Positive Technologies (AI Summary)

CVSS v2.0

1.5

Baixa

Vetor base

AV:L/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 8.4.0 through 8.4.1 Exchange Server 2007 Exchange Server 2010 Exchange Server 2013

Description The issue allows attackers to affect availability and potentially execute arbitrary code. In the case of Exchange Server, vulnerabilities exist in the WebReady Document Viewing feature, which could allow remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser. The LocalService account has minimum privileges on the local computer and presents anonymous credentials on the network.

Recommendations For Oracle Fusion Middleware versions 8.4.0 through 8.4.1, update to a version that addresses the issue in the Outside In Technology component. For Exchange Server 2007, Exchange Server 2010, and Exchange Server 2013, disable the WebReady Document Viewing feature until a patch is available to prevent remote code execution through specially crafted files. As a temporary workaround, consider restricting access to the WebReady Document Viewing feature in Exchange Server to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2013-5791

Produtos afetados

Exchange Server

Exchange Server 2007

Exchange Server 2010

Exchange Server 2013

Oracle Fusion Middleware

Referências · 16

• 🔥 https://exploit-db.com/exploits/31222 · Exploit
• 🔥 http://exploit-db.com/exploits/31222 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-105 · Aviso do Fabricante
• http://secunia.com/advisories/56237 · Nota
• http://securityfocus.com/bid/63076 · Nota
• http://kb.cert.org/vuls/id/953241 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21660640 · Nota
• http://citadelo.com/en/ms13-105-oracle-outside-in-mdb-parsing-vulnerability-cve-2013-5791 · Nota
• http://secunia.com/advisories/56243 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5791 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/cpuoct2013-1899837.html · Aviso do Fabricante
• http://securitytracker.com/id/1029190 · Nota
• http://secunia.com/advisories/56241 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5791 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5791 · Nota de Segurança