Rapid7 Vulnerability & Exploit Database

CVE-2018-8474: Lync for Mac 2011 Security Feature Bypass Vulnerability [Office for Mac]

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

CVE-2018-8474: Lync for Mac 2011 Security Feature Bypass Vulnerability [Office for Mac]

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
09/11/2018
Created
03/19/2019
Added
09/17/2018
Modified
11/21/2018

Description

A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages. An attacker who successfully exploited this vulnerability could cause a targeted Lync for Mac 2011 user's system to browse to an attacker-specified website or automatically download file types on the operating system's safe file type list.

For an attacker to exploit the vulnerability, a specially crafted message needs to be sent to a targeted user. The targeted user does not need to take any actions after receiving the message.

Microsoft is not planning on fixing this vulnerability in Microsoft Lync for Mac 2011. Microsoft recommends upgrading to Skype for Business on Mac.

Solution(s)

  • office-for-mac-upgrade-latest

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
  • Lightweight Endpoint Agent
  • Live Dashboards
  • Real Risk Prioritization
  • IT-Integrated Remediation Projects
  • Cloud, Virtual, and Container Assessment
  • Integrated Threat Feeds
  • Easy-to-Use RESTful API
  • Automation-Assisted Patching
  • Automated Containment
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;