PT-2013-5770 · Microsoft+1 · Exchange Server 2007+4

Published 2013-12-10 · Updated 2018-10-12 · CVE-2013-5763

Positive Technologies (AI Summary)

CVSS v2.0

1.5

Low

Base vector

AV:L/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware version 8.4.0 Exchange Server 2007 Exchange Server 2010 Exchange Server 2013

Description The issue allows attackers to affect availability or execute remote code, depending on the context. For Exchange Server, the vulnerability exists through the WebReady Document Viewing feature, allowing remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser. The LocalService account has minimum privileges on the local computer and presents anonymous credentials on the network.

Recommendations For Oracle Fusion Middleware version 8.4.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Exchange Server 2007, update to a version that does not use the vulnerable WebReady Document Viewing feature. For Exchange Server 2010, update to a version that does not use the vulnerable WebReady Document Viewing feature. For Exchange Server 2013, update to a version that does not use the vulnerable WebReady Document Viewing feature.

Related Identifiers

CVE-2013-5763

Affected Products

Exchange Server

Exchange Server 2007

Exchange Server 2010

Exchange Server 2013

Oracle Fusion Middleware

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2013-5763 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-105 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpuoct2013-1899837.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5763 · Security Note
• http://secunia.com/advisories/56237 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5763 · Note
• http://securitytracker.com/id/1029190 · Note
• http://secunia.com/advisories/56241 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21660640 · Note
• http://securityfocus.com/bid/63741 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-105 · Note
• http://secunia.com/advisories/56243 · Note