PT-2012-3593 · Microsoft · Lync+2

Hamburgers Maccoy · Published 2012-06-12 · Updated 2018-10-12 · CVE-2012-1849

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Lync versions 2010 Microsoft Lync Attendee version 2010 Microsoft Lync Attendant version 2010

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. This can be demonstrated by a directory that contains a .ocsmeet file.

Recommendations For Microsoft Lync 2010, consider restricting access to untrusted directories to minimize the risk of exploitation. For Microsoft Lync Attendee 2010, avoid using untrusted search paths until the issue is resolved. For Microsoft Lync Attendant 2010, as a temporary workaround, consider disabling the loading of DLLs from the current working directory until a patch is available.

Fix

Related Identifiers

CVE-2012-1849

Affected Products

Lync

Lync Attendant

Lync Attendee

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-1849 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA12-164A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14874 · Note