Microsoft Forefront Unified Access Gateway 'MicrosoftClient.Jar' Remote Code Execution Vulnerability

Bugtraq ID:	49983
Class:	Design Error
CVE:	CVE-2011-1969
Remote:	Yes
Local:	No
Published:	Oct 11 2011 12:00AM
Updated:	Apr 19 2013 02:40AM
Credit:	Microsoft
Vulnerable:
Not Vulnerable:

Microsoft Forefront Unified Access Gateway 'MicrosoftClient.Jar' Remote Code Execution Vulnerability

Microsoft Forefront Unified Access Gateway is prone to a remote code-execution vulnerability.

Successful exploits will allow attackers to execute arbitrary code in the context of the logged-in user.

Microsoft Forefront Unified Access Gateway 'MicrosoftClient.Jar' Remote Code Execution Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage.

Microsoft Forefront Unified Access Gateway 'MicrosoftClient.Jar' Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the referenced advisory for details.

Microsoft Forefront Unified Access Gateway 'MicrosoftClient.Jar' Remote Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• SEC Consult SA-20111012-0 :: Client-side remote file upload & command execution (Full Disclosure mailing list)
  
• Microsoft Security Bulletin MS11-079 (Microsoft)