PT-2014-1675 · Microsoft · Lync Server

Peter Schraffl · Published 2014-09-09 · Updated 2018-10-12 · CVE-2014-4068

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server versions 2010 through 2013

Description The issue allows an attacker to cause a denial of service, resulting in a system hang, by sending a crafted call. This is due to improper exception handling in the Response Group Service in Microsoft Lync Server 2010 and 2013, and the Core Components in Lync Server 2013.

Recommendations For Microsoft Lync Server 2010, update to a version that properly handles exceptions to prevent the denial of service. For Microsoft Lync Server 2013, update the Core Components to a version that correctly handles exceptions, preventing the system hang. As a temporary workaround, consider restricting access to the Response Group Service to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-00611

CVE-2014-4068

Affected Products

Lync Server

References · 9

• https://bdu.fstec.ru/vul/2015-00611 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4068 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4068 · Security Note
• http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-september-2014-security-updates.aspx · Note
• http://securitytracker.com/id/1030821 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-055 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95544 · Note
• http://securityfocus.com/bid/69586 · Note