SMB: Microsoft Lync Insecure Library Loading

This signature detects attempts to exploit a known vulnerability against Microsoft Lync. A successful attack can lead to arbitrary code execution.

Extended Description

Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .ocsmeet file, aka "Lync Insecure Library Loading Vulnerability."

Affected Products

Microsoft lync

References

CVE: CVE-2012-1849

URL: http://technet.microsoft.com/en-us/security/bulletin/ms12-039

Short Name

SMB:FILE:MS-LYNC-INSCR-LIBLDG

Severity

Critical

Recommended

False

Recommended Action

Drop

SMB: Microsoft Lync Insecure Library Loading

Extended Description

Affected Products

References

Found a potential security threat?