Less Severe Flaws affect Two Lesser-known Microsoft Products

Do you use, or have you even heard of, Microsoft’s Lync or Dynamic AX Enterprise Portal? If so, you should go patch.

Along with the other Patch Day bulletins, Microsoft released updates for two products which I suspect only limited audiences know about. Nonetheless, if you use either of these products, you will want to install Microsoft’s security updates for them at your earliest convenience.

The first update is a security patch for Microsoft Lync. Lync is a unified communications tool that combines voice, IM, audio, video, and web-based communication into one interface. It’s essentially the replacement for Microsoft Communicator, which I think most people have heard of. Being so new, I don’t think many organizations have moved to Lync yet, but it surely will become more popular as people move away from Communicator.

In any case, Lync suffers from four security vulnerabilities, the worst involving how it handles specially crafted TrueType fonts. By enticing you to open content containing a malicious TrueType font in Lync, an attacker can exploit this flaw to execute code on your machine, with your privileges. If you have local administrative privilege, as most Windows users do, the attacker gains full control of your machine. If you are an early adopter of Microsoft’s Lync, be sure to apply its updates found in the “Affected and Non-Affected Software” section of Microsoft’s bulletin.

The second update for lesser-known Microsoft software affects their Dynamics AX Enterprise Portal. Apparently, Dynamics AX is one of Microsoft’s enterprise resource planning (ERP) solutions, and the Enterprise Portal is a web-based application to interact with Dynamic AX. Unfortunately, the web portal suffers from a cross-site scripting (XSS) flaw, which attackers could leverage to gain access to your portal with the same privilege as one of your users, thus potentially gaining access to sensitive corporate data. If you use Dynamics AX, make sure to apply Microsoft’s update.

To conclude, though I suspect less of you use these relatively new Microsoft products, you should definitely check out today’s bulletins for them, and apply the appropriate updates if you do.  — Corey Nachreiner, CISSP (@SecAdept)

About Corey Nachreiner

Corey Nachreiner has been with WatchGuard since 1999 and has since written more than a thousand concise security alerts and easily-understood educational articles for WatchGuard users. His security training videos have generated hundreds of letters of praise from thankful customers and accumulated more than 100,000 views on YouTube and Google Video. A Certified Information Systems Security Professional (CISSP), Corey speaks internationally and is often quoted by other online sources, including C|NET, eWeek, and Slashdot. Corey enjoys "modding" any technical gizmo he can get his hands on, and considers himself a hacker in the old sense of the word.

2 Responses to “Less Severe Flaws affect Two Lesser-known Microsoft Products”

  1. I was wondering if you ever considered changing the layout of your website?
    Its very well written; I love what youve got to say. But maybe you could a little more in
    the way of content so people could connect with it better.
    Youve got an awful lot of text for only having 1 or 2 pictures.
    Maybe you could space it out better?

Trackbacks/Pingbacks

  1. WatchGuard Security Week in Review: Episode 22 | WatchGuard Security Center - June 15, 2012

    [...] Lync and Dynamics AX updates [...]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 7,622 other followers

%d bloggers like this: