Microsoft Lync Insecure Library Loading Code Execution (MS12-039; CVE-2012-1849)
| Check Point Reference: | CPAI-2012-254 | |
| Date Published: | ||
| Severity: | ||
| Source: | Microsoft Security Bulletin MS12-039 | |
| Industry Reference(s): | CVE-2012-1849 | |
| Protection Provided by: |
Security Gateway
|
|
|
Who is Vulnerable? Microsoft Lync 2010 Microsoft Lync 2010 Attendee Microsoft Lync 2010 Attendant (32-bit) Microsoft Lync 2010 Attendant (64-bit) |
||
| Vulnerability Description A remote code execution vulnerability has been reported in Microsoft Lync. |
||
|
Update/Patch Available Apply patches from: MS12-039 |
|
|
Vulnerability Details The vulnerability is due to an error in the way Microsoft Lync restricts the path used for loading external libraries. A remote attacker could exploit this issue by enticing a user to open a legitimate Lync file (such as an .ocsmeet file) that is located in the same network directory as a specially crafted dynamic link library (DLL) file. Successful exploitation will allow an attacker to execute arbitrary code on an affected system, in the security context of the logged on user. |
Protection Overview
This protection will detect and block the transferring of malicious DLL files over a network share.
In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.