CVE-2013-1302

Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.us-cert.gov/ncas/alerts/TA13-134A	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952
http://www.us-cert.gov/ncas/alerts/TA13-134A	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:lync:2010::attendee:::::
	cpe:2.3:a:microsoft:lync:2010::x64:::::
	cpe:2.3:a:microsoft:lync:2010::x86:::::
	cpe:2.3:a:microsoft:lync_server:2013:::::::*
	cpe:2.3:a:microsoft:office_communicator:2007:r2::::::

History

21 Nov 2024, 01:49

Type	Values Removed	Values Added
References	~~() http://www.us-cert.gov/ncas/alerts/TA13-134A - Third Party Advisory, US Government Resource~~	() http://www.us-cert.gov/ncas/alerts/TA13-134A - Third Party Advisory, US Government Resource
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041 -
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952 -~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952 -

Information

Published : 2013-05-15 03:36

Updated : 2024-11-21 01:49

NVD link : CVE-2013-1302

Mitre link : CVE-2013-1302

CVE.ORG link : CVE-2013-1302

JSON object : View

Products Affected

microsoft

office_communicator
lync_server
lync

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2013-1302", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-05-15T03:36:33.427", "references": [{"url": "http://www.us-cert.gov/ncas/alerts/TA13-134A", "tags": ["Third Party Advisory", "US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/ncas/alerts/TA13-134A", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka \"Lync RCE Vulnerability.\""}, {"lang": "es", "value": "Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, y Lync Server 2013 no maneja correctamente ojbetos en memoria, lo que permite a atacantes remotos ejecutar c\u00f3digo arbitrario mediante una invitaci\u00f3n que genera el acceso a un objeto eliminado, tambi\u00e9n conocido como \"Vulnerabilidad"}], "lastModified": "2024-11-21T01:49:19.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:lync:2010:*:attendee:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE98CEE9-200B-494A-B645-D14ACB577250"}, {"criteria": "cpe:2.3:a:microsoft:lync:2010:*:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF2C62AD-CC37-42B4-88AD-75F8F603ADEB"}, {"criteria": "cpe:2.3:a:microsoft:lync:2010:*:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F01B787D-6263-4753-977D-211432447E38"}, {"criteria": "cpe:2.3:a:microsoft:lync_server:2013:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "677D4F3D-1374-4F6F-B69E-7F9F507D18A4"}, {"criteria": "cpe:2.3:a:microsoft:office_communicator:2007:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7234718B-FD5B-4C9E-8D32-E0A9DDDA7619"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}