PT-2015-2714 · Microsoft · Skype For Business+3

Publicado 2015-11-11 · Atualizado 2018-10-12 · CVE-2015-6061

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Lync versions 2010 through 2013 SP1 Microsoft Skype for Business version 2016 Lync 2010 Attendee (affected versions not specified) Lync Room System (affected versions not specified)

Description The issue exists due to inadequate protection of the web page structure in Microsoft's instant messaging software. This allows a remote attacker to inject arbitrary web script or HTML code via an instant-message session.

Recommendations For Microsoft Lync versions 2010 through 2013 SP1, consider disabling instant messaging sessions until a patch is available. For Microsoft Skype for Business version 2016, restrict access to instant messaging features to minimize the risk of exploitation. For Lync 2010 Attendee and Lync Room System, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-12079

CVE-2015-6061

Produtos afetados

Lync 2010 Attendee

Lync Room System

Lync

Skype For Business

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-6061 · Nota de Segurança
• http://securitytracker.com/id/1034126 · Nota
• http://securitytracker.com/id/1034127 · Nota
• https://bdu.fstec.ru/vul/2015-12079 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-123 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS15-123 · Nota