MS12-039 - Vulnerabilities in Lync Could Allow Remote Code Execution (2707956)

Click any highlighted term for further explanation. For more information, contact technical support.

 

Details
Vulnerability name/brief description MS12-039 - Vulnerabilities in Lync Could Allow Remote Code Execution (2707956)
CVE/CAN name
Vendor threat level Important
SophosLabs threat level High
Solution MS12-039
Vendor description This security update resolves one publicly disclosed vulnerability and three privately reported vulnerabilities in Microsoft Lync. The most severe vulnerabilities could allow remote code execution if a user views shared content that contains specially crafted TrueType fonts. This security update is rated Important for Microsoft Lync 2010, Microsoft Lync 2010 Attendee, Microsoft Lync 2010 Attendant (32-bit), and Microsoft Lync 2010 Attendant (64-bit). The security update addresses the vulnerabilities by correcting how specially crafted True Type Font files are handled, correcting the manner in which Microsoft Lync loads external libraries, and modifying the way that SafeHTML function sanitizes HTML content.
SophosLabs comments Of most importance is the publicly disclosed vulnerability CVE-2011-3402 (TrueType Font Parsing Vulnerability), which potentially exposes users to a remote code execution attack when an attacker shares file containing specially crafted True Type Font (TTF) files. This attack has previously been used in very limited, targeted attacks using exploited attack vectors that were addressed in MS11-087. Neither Microsoft nor Sophos at the present moment had received any information to indicate that the this vulnerability had been publicly used to attack customers. This may be subjected to change and Sophos will continue to monitor the situation.
SophosLabs testing result No SophosLabs testing result found
Currently known exploits
First sample seen No samples found
Discovery date 12 Jun 2012
Affected software Microsoft Communicator 2007 R2
Microsoft Lync 2010 (32-bit)
Microsoft Lync 2010 (64-bit)
Microsoft Lync 2010 Attendee (admin level install)
Microsoft Lync 2010 Attendee (user level install)
Microsoft Lync 2010 Attendant (32-bit)
Microsoft Lync 2010 Attendant (64-bit)
References
Credits
  • MAPP
Revisions
  • June 12th, 2012 - Initial analysis written

Explanation of terms

Vulnerability Name/Brief Description:

Vendor identifier plus a brief description of the type of attack.

CVE/CAN Name:

Currently assigned CVE name. If a CVE name doesn't exist the CAN name will be used until a CVE has been assigned.

Vendor Threat Level:

Threat level assigned by the vendor

SophosLabs Threat Level:

Threat level assigned by SophosLabs

  • LOW RISK - There is little chance of this vulnerability being actively exploited by malware.
  • MEDIUM RISK - There is a possibility of this vulnerability being actively exploited by malware.
  • HIGH RISK - There is a strong possibility of this vulnerability being actively exploited by malware.
  • CRITICAL RISK - This vulnerability will almost certainly be actively exploited by malware.

Solution:

Vendor-supplied Patch identifier and recommended solution, or workaround if applicable.

Vendor Description:

Summary of the cause and potential effect of the vulnerability provided by the vendor.

SophosLabs Comments:

SophosLabs' opinions and observations of the vulnerability in question.

SophosLabs Testing Result:

Details of completed lab testing, if applicable. Please note that the lab test environment may differ significantly from user environments.

Currently Known Exploits:

List of identities for known exploits, if applicable.

First Sample Seen:

Date of the first sample seen by SophosLabs.

Discovery Date:

Date of the earliest known publically disclosed advisory.

Affected Software:

Vulnerable platforms and software versions.

© 1997 - 2013 Sophos Ltd. All rights reserved. Legal Privacy Cookie Information