Less Severe Flaws affect Two Lesser-known Microsoft Products

Do you use, or have you even heard of, Microsoft’s Lync or Dynamic AX Enterprise Portal? If so, you should go patch.

Along with the other Patch Day bulletins, Microsoft released updates for two products which I suspect only limited audiences know about. Nonetheless, if you use either of these products, you will want to install Microsoft’s security updates for them at your earliest convenience.

The first update is a security patch for Microsoft Lync. Lync is a unified communications tool that combines voice, IM, audio, video, and web-based communication into one interface. It’s essentially the replacement for Microsoft Communicator, which I think most people have heard of. Being so new, I don’t think many organizations have moved to Lync yet, but it surely will become more popular as people move away from Communicator.

In any case, Lync suffers from four security vulnerabilities, the worst involving how it handles specially crafted TrueType fonts. By enticing you to open content containing a malicious TrueType font in Lync, an attacker can exploit this flaw to execute code on your machine, with your privileges. If you have local administrative privilege, as most Windows users do, the attacker gains full control of your machine. If you are an early adopter of Microsoft’s Lync, be sure to apply its updates found in the “Affected and Non-Affected Software” section of Microsoft’s bulletin.

The second update for lesser-known Microsoft software affects their Dynamics AX Enterprise Portal. Apparently, Dynamics AX is one of Microsoft’s enterprise resource planning (ERP) solutions, and the Enterprise Portal is a web-based application to interact with Dynamic AX. Unfortunately, the web portal suffers from a cross-site scripting (XSS) flaw, which attackers could leverage to gain access to your portal with the same privilege as one of your users, thus potentially gaining access to sensitive corporate data. If you use Dynamics AX, make sure to apply Microsoft’s update.

To conclude, though I suspect less of you use these relatively new Microsoft products, you should definitely check out today’s bulletins for them, and apply the appropriate updates if you do.  — Corey Nachreiner, CISSP (@SecAdept)