Detections
Analytics
MS13-012: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution (2809279)
medium Nessus Plugin ID 64573
Language:
Synopsis
The remote mail server has multiple vulnerabilities.Description
The version of Microsoft Exchange installed on the remote host is affected by multiple code execution vulnerabilities.The vulnerabilities exist in the Oracle Outside In libraries, used by the WebReady Document Viewing feature of Outlook Web App (OWA). An attacker could exploit this by sending a malicious email attachment to a user who views it in OWA, resulting in arbitrary code execution as LocalService.
Solution
Microsoft has released a set of patches for Exchange 2007 SP3 and 2010 SP2.See Also
https://www.zerodayinitiative.com/advisories/ZDI-13-001/
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2013/ms13-012
Plugin Details
Severity: Medium
ID: 64573
File Name: smb_nt_ms13-012.nasl
Version: 1.14
Type: local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 2/12/2013
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:exchange_server
Required KB Items: SMB/MS_Bulletin_Checks/Possible
Exploit Ease: No known exploits are available
Patch Publication Date: 2/12/2013
Vulnerability Publication Date: 1/16/2013
Reference Information
CVE: CVE-2013-0393, CVE-2013-0418