Multiple vulnerabilities in Microsoft Skype for Business and Lync



Published: 2021-05-11
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-26422
CVE-2021-26421
CWE-ID CWE-94
CWE-451
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Skype for Business Server
Server applications / Conferencing, Collaboration and VoIP solutions

Microsoft Lync
Client/Desktop applications / Messaging software

Vendor Microsoft

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Code Injection

EUVDB-ID: #VU53102

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-26422

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Skype for Business and Lync. A remote administrator can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Skype for Business Server: 2015 CU11 - 2019 CU5

Microsoft Lync: 2013 CU10


CPE2.3 External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26422

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Spoofing attack

EUVDB-ID: #VU53103

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-26421

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in Skype for Business and Lync. A remote authenticated attacker can spoof page content.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft Lync: 2013 CU10

Skype for Business Server: 2015 CU11


CPE2.3 External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26421

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###