Test ID:	1.3.6.1.4.1.25623.1.0.902842
Category:	Windows : Microsoft Bulletins
Title:	Microsoft Lync Remote Code Execution Vulnerabilities (2707956)
Summary:	This host is missing a critical security update according to; Microsoft Bulletin MS12-039.
Description:	Summary: This host is missing a critical security update according to Microsoft Bulletin MS12-039. Vulnerability Insight: - An error within the Win32k kernel-mode driver (win32k.sys) when parsing TrueType fonts. - An error in the t2embed.dll module when parsing TrueType fonts. - The client loads libraries in an insecure manner, which can be exploited to load arbitrary libraries by tricking a user into opening a '.ocsmeet' file located on a remote WebDAV or SMB share. - An unspecified error in the 'SafeHTML' API when sanitising HTML code can be exploited to execute arbitrary HTML and script code in the user's chat session. Vulnerability Impact: Successful exploitation could allow an attacker to execute arbitrary code with kernel-level privileges. Failed exploit attempts may result in a denial of service condition. Affected Software/OS: - Microsoft Lync 2010 - Microsoft Lync 2010 Attendee - Microsoft Lync 2010 Attendant - Microsoft Communicator 2007 R2 Solution: The vendor has released updates. Please see the references for more information. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-3402 Cert/CC Advisory: TA11-347A http://www.us-cert.gov/cas/techalerts/TA11-347A.html Cert/CC Advisory: TA12-129A http://www.us-cert.gov/cas/techalerts/TA12-129A.html Cert/CC Advisory: TA12-164A http://www.us-cert.gov/cas/techalerts/TA12-164A.html http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files http://isc.sans.edu/diary/Duqu+Mitigation/11950 http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf Microsoft Security Bulletin: MS11-087 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 Microsoft Security Bulletin: MS12-034 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034 Microsoft Security Bulletin: MS12-039 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645 http://www.securitytracker.com/id?1027039 http://secunia.com/advisories/49121 http://secunia.com/advisories/49122 Common Vulnerability Exposure (CVE) ID: CVE-2012-0159 BugTraq ID: 53335 http://www.securityfocus.com/bid/53335 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667 XForce ISS Database: microsoft-truetype-code-exec(75124) https://exchange.xforce.ibmcloud.com/vulnerabilities/75124 Common Vulnerability Exposure (CVE) ID: CVE-2012-1849 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14874 Common Vulnerability Exposure (CVE) ID: CVE-2012-1858 Cert/CC Advisory: TA12-192A http://www.us-cert.gov/cas/techalerts/TA12-192A.html Microsoft Security Bulletin: MS12-037 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037 Microsoft Security Bulletin: MS12-050 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15530
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.