PT-2014-1674 · Microsoft · Lync Server 2013

Published 2014-09-09 · Updated 2018-10-12 · CVE-2014-4071

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server 2013

Description The issue allows an attacker to cause a denial of service, resulting in a system crash. This can be achieved through a crafted request, which leads to a NULL pointer dereference and daemon hang.

Recommendations For Microsoft Lync Server 2013, consider restricting access to the server to minimize the risk of exploitation until a patch is available. As a temporary workaround, apply configuration changes to limit the impact of crafted requests.

Fix

Related Identifiers

BDU:2015-00610

CVE-2014-4071

Affected Products

Lync Server 2013

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4071 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4071 · Security Note
• https://bdu.fstec.ru/vul/2015-00610 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-055 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95547 · Note
• http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-september-2014-security-updates.aspx · Note
• http://securitytracker.com/id/1030821 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-055 · Note
• http://securityfocus.com/bid/69592 · Note