Security Updates for Microsoft Skype for Business and Microsoft Lync (July 2019)

Medium Nessus Plugin ID 126628

Synopsis

The Microsoft Skype for Business or Microsoft Lync installation on the remote host is missing a security update.

Description

The Microsoft Skype for Business or Microsoft Lync installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability :

- An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients.
(CVE-2019-1084)

Solution

Microsoft has released the following security updates to address this issue:
-KB4475545
-KB4475519

See Also

http://www.nessus.org/u?71a77b93

http://www.nessus.org/u?b3294b7a

Plugin Details

Severity: Medium

ID: 126628

File Name: smb_nt_ms19_jul_skype.nasl

Version: 1.1

Type: local

Agent: windows

Published: 2019/07/11

Updated: 2019/07/11

Dependencies: 68879, 13855, 27524, 57033

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2019-1084

CVSS v2.0

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS v3.0

Base Score: 5.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Vulnerability Information

CPE: cpe:/a:microsoft:skype_for_business, cpe:/a:microsoft:lync

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Patch Publication Date: 2019/07/09

Vulnerability Publication Date: 2019/07/09

Reference Information

CVE: CVE-2019-1084

MSKB: 4475545, 4475519

MSFT: MS19-4475545, MS19-4475519

IAVA: 2019-A-0233