PT-2015-2714 · Microsoft · Skype For Business+3

Published 2015-11-11 · Updated 2018-10-12 · CVE-2015-6061

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Lync versions 2010 through 2013 SP1 Microsoft Skype for Business version 2016 Lync 2010 Attendee (affected versions not specified) Lync Room System (affected versions not specified)

Description The issue exists due to inadequate protection of the web page structure in Microsoft's instant messaging software. This allows a remote attacker to inject arbitrary web script or HTML code via an instant-message session.

Recommendations For Microsoft Lync versions 2010 through 2013 SP1, consider disabling instant messaging sessions until a patch is available. For Microsoft Skype for Business version 2016, restrict access to instant messaging features to minimize the risk of exploitation. For Lync 2010 Attendee and Lync Room System, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-12079

CVE-2015-6061

Affected Products

Lync 2010 Attendee

Lync Room System

Lync

Skype For Business

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-6061 · Security Note
• https://bdu.fstec.ru/vul/2015-12079 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-123 · Vendor Advisory
• http://securitytracker.com/id/1034126 · Note
• http://securitytracker.com/id/1034127 · Note
• http://technet.microsoft.com/security/bulletin/MS15-123 · Note