PT-2012-3517 · Microsoft · Exchange Server

Will Dorman · Published 2012-07-17 · Updated 2018-10-12 · CVE-2012-1766

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description Remote code execution issues exist due to the WebReady Document Viewing feature. This could allow code execution as Local System if a user views a specially crafted file through Outlook Web Access in a browser. An attacker could run code on the server, but only with LocalService privileges, which have minimal local computer privileges and present anonymous network credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2012-1766

Affected Products

Exchange Server

References · 16

• http://oracle.com/technetwork/topics/security/cpujul2012-392727.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1766 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-067 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-058 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1766 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15724 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-058 · Note
• http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx · Note
• http://securitytracker.com/id?1027264 · Note
• http://technet.microsoft.com/security/advisory/2737111 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1766 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76999 · Note
• http://kb.cert.org/vuls/id/118913 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21660640 · Note