Permissions, Privileges, and Access Controls in Windows Essentials - CVE-2013-0096

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability." Per: http://technet.microsoft.com/en-us/security/bulletin/ms13-045 'There is no update available for Windows Essentials 2011. See update FAQ for details.'

How to mitigate CVE-2013-0096

Sources

• http://www.us-cert.gov/ncas/alerts/TA13-134A
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-045
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16204