• Articles
    • Editorial Articles
    • Research Articles
    • WatchGuard Articles
  • The 443 Podcast
  • Threat Landscape
  • About
    • About Us
    • Contact Us
    • Contribute to Secplicity

Secplicity - Security Simplified

Powered by WatchGuard Technologies

Less Severe Flaws affect Two Lesser-known Microsoft Products

June 12, 2012 By Corey Nachreiner

Do you use, or have you even heard of, Microsoft’s Lync or Dynamic AX Enterprise Portal? If so, you should go patch.

Along with the other Patch Day bulletins, Microsoft released updates for two products which I suspect only limited audiences know about. Nonetheless, if you use either of these products, you will want to install Microsoft’s security updates for them at your earliest convenience.

The first update is a security patch for Microsoft Lync. Lync is a unified communications tool that combines voice, IM, audio, video, and web-based communication into one interface. It’s essentially the replacement for Microsoft Communicator, which I think most people have heard of. Being so new, I don’t think many organizations have moved to Lync yet, but it surely will become more popular as people move away from Communicator.

In any case, Lync suffers from four security vulnerabilities, the worst involving how it handles specially crafted TrueType fonts. By enticing you to open content containing a malicious TrueType font in Lync, an attacker can exploit this flaw to execute code on your machine, with your privileges. If you have local administrative privilege, as most Windows users do, the attacker gains full control of your machine. If you are an early adopter of Microsoft’s Lync, be sure to apply its updates found in the “Affected and Non-Affected Software” section of Microsoft’s bulletin.

The second update for lesser-known Microsoft software affects their Dynamics AX Enterprise Portal. Apparently, Dynamics AX is one of Microsoft’s enterprise resource planning (ERP) solutions, and the Enterprise Portal is a web-based application to interact with Dynamic AX. Unfortunately, the web portal suffers from a cross-site scripting (XSS) flaw, which attackers could leverage to gain access to your portal with the same privilege as one of your users, thus potentially gaining access to sensitive corporate data. If you use Dynamics AX, make sure to apply Microsoft’s update.

To conclude, though I suspect less of you use these relatively new Microsoft products, you should definitely check out today’s bulletins for them, and apply the appropriate updates if you do.  — Corey Nachreiner, CISSP (@SecAdept)

Share This:

Related

Filed Under: Security Bytes

Comments

  1. X++ Developers says

    October 11, 2013 at 5:23 am

    I was wondering if you ever considered changing the layout of your website?
    Its very well written; I love what youve got to say. But maybe you could a little more in
    the way of content so people could connect with it better.
    Youve got an awful lot of text for only having 1 or 2 pictures.
    Maybe you could space it out better?

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

The 443 Podcast

A weekly podcast featuring the leading white-hat hackers and security researchers. Listen Now
the 443 podcast

Threat Landscape

Filter and view Firebox Feed data by type of attack, region, country, and date range. View Now
threat landscape

Top Posts

  • Scratching the Surface of Rhysida Ransomware
  • An Interview with ChatGPT
  • TikTok is Banned, Kind Of
  • Naming APTs

Email Newsletter

Sign up to get the latest security news and threat analysis delivered straight to your inbox

By signing up you agree to our Privacy Policy.


The views and opinions expressed on this website are those of the authors and do not necessarily reflect the policy or position of WatchGuard Technologies.

Stay in Touch

Recent Posts

  • How Not to Update Software
  • Naming APTs
  • TikTok is Banned, Kind Of
  • Scratching the Surface of Rhysida Ransomware
  • An Interview with ChatGPT
View All

Search

Archives

Copyright © 2023 WatchGuard Technologies · Cookie Policy · Privacy Policy · Terms of Use