PT-2013-4620 · Microsoft+1 · Exchange Server 2013+2

Takahiro Haruyama · Published 2013-07-17 · Updated 2018-10-12 · CVE-2013-3781

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 8.3.7 through 8.4.1 Exchange Server 2013 (affected versions not specified)

Description The issue affects the availability of the system. In the case of Exchange Server 2013, the vulnerability is related to the Data Loss Protection (DLP) feature and can cause the server to become unresponsive when a user views a specially crafted file through Outlook Web Access in a browser. For Oracle Fusion Middleware, the vulnerability is related to the Outside In Technology component, specifically Outside In Filters.

Recommendations For Oracle Fusion Middleware versions 8.3.7 through 8.4.1, update to a version that addresses the issue. For Exchange Server 2013, avoid viewing specially crafted files through Outlook Web Access in a browser until a fix is available. As a temporary workaround, consider restricting access to the DLP feature in Exchange Server 2013 to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2013-3781

Affected Products

Exchange Server

Exchange Server 2013

Oracle Fusion Middleware

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3781 · Security Note
• http://oracle.com/technetwork/topics/security/cpujuly2013-1899826.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3781 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-061 · Vendor Advisory
• http://jvn.jp/en/jp/JVN07497769/index.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-061 · Note
• http://securitytracker.com/id/1028801 · Note
• http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000070.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3781 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21660640 · Note
• http://securityfocus.com/bid/61232 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18156 · Note