PT-2014-1675 · Microsoft · Lync Server

Peter Schraffl · Publicado 2014-09-09 · Atualizado 2018-10-12 · CVE-2014-4068

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server versions 2010 through 2013

Description The issue allows an attacker to cause a denial of service, resulting in a system hang, by sending a crafted call. This is due to improper exception handling in the Response Group Service in Microsoft Lync Server 2010 and 2013, and the Core Components in Lync Server 2013.

Recommendations For Microsoft Lync Server 2010, update to a version that properly handles exceptions to prevent the denial of service. For Microsoft Lync Server 2013, update the Core Components to a version that correctly handles exceptions, preventing the system hang. As a temporary workaround, consider restricting access to the Response Group Service to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-00611

CVE-2014-4068

Produtos afetados

Lync Server

Referências · 9

• http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-september-2014-security-updates.aspx · Nota
• https://bdu.fstec.ru/vul/2015-00611 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4068 · Nota de Segurança
• http://securitytracker.com/id/1030821 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms14-055 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95544 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-055 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-4068 · Nota de Segurança
• http://securityfocus.com/bid/69586 · Nota