PT-2013-3060 · Microsoft · Lync 2010+3

Published 2013-05-15 · Updated 2018-10-12 · CVE-2013-1302

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lync Server 2013 Lync 2010 Lync 2010 Attendee Microsoft Communicator 2007 R2

Description The issue arises from improper handling of objects in memory, allowing remote attackers to execute arbitrary code. This can be achieved by sending an invitation that triggers access to a deleted object.

Recommendations For Microsoft Communicator 2007 R2, update to a version that properly handles objects in memory. For Lync 2010, update to a version that properly handles objects in memory. For Lync 2010 Attendee, update to a version that properly handles objects in memory. For Lync Server 2013, update to a version that properly handles objects in memory.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-1302

Affected Products

Lync 2010

Lync 2010 Attendee

Lync Server 2013

Communicator 2007 R2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-1302 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952 · Note
• http://us-cert.gov/ncas/alerts/TA13-134A · Note