Multiple Microsoft Products CVE-2013-3906 Remote Code Execution Vulnerability

Bugtraq ID:	63530
Class:	Unknown
CVE:	CVE-2013-3906
Remote:	Yes
Local:	No
Published:	Nov 05 2013 12:00AM
Updated:	Dec 11 2013 01:07AM
Credit:	Haifei Li of McAfee Labs IPS Team
Vulnerable:	Microsoft Windows Vista x64 Edition SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Office Compatibility Pack SP3 Microsoft Office 2010 (64-bit edition) SP1 Microsoft Office 2010 (32-bit edition) SP1 Microsoft Office 2007 SP3 Microsoft Office 2003 SP3 Microsoft Lync 2010 Attendee 0
Not Vulnerable:

Multiple Microsoft Products CVE-2013-3906 Remote Code Execution Vulnerability

Multiple Microsoft products including Microsoft Windows, Microsoft Office, and Microsoft Lync are prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user, which may lead to a complete compromise of an affected computer.

Multiple Microsoft Products CVE-2013-3906 Remote Code Execution Vulnerability

The vendor reports this issue is being exploited in the wild in active targeted attacks.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/63530.rb

Multiple Microsoft Products CVE-2013-3906 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Microsoft Products CVE-2013-3906 Remote Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)