Vulnerability Description
Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Lync | 2010 |
| Microsoft | Lync Server | 2013 |
| Microsoft | Office Communicator | 2007 |
Related Weaknesses (CWE)
References
- http://www.us-cert.gov/ncas/alerts/TA13-134AThird Party AdvisoryUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-04
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://www.us-cert.gov/ncas/alerts/TA13-134AThird Party AdvisoryUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-04
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
FAQ
What is CVE-2013-1302?
CVE-2013-1302 is a vulnerability with a CVSS score of 9.3 (HIGH). Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation ...
How severe is CVE-2013-1302?
CVE-2013-1302 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-1302?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Lync, Microsoft Lync Server, Microsoft Office Communicator.