MS14-055  Vulnerabilities in Microsoft Lync Server Could Allow Denial of Service

2014-09-09 This security update resolves three privately reported vulnerabilities in Microsoft Lync Server. The most severe of these vulnerabilities could allow information disclosure if user clicks on a specially crafted URL. In all cases, however, an attacker would have to convince users to click on the specially crafted URL, typically by getting them to click the URL in an email message or in an Instant Messenger request.
Vulnerabilities addressed in this bulletin:

Lync Denial of Service Vulnerability

A denial of service vulnerability exists in Lync Server. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding.
CVE-2014-4068

Lync XSS Information Disclosure Vulnerability

A reflected cross-site scripting (XSS) vulnerability which could result in information disclosure exists when Lync Server fails to properly sanitize specially crafted content. An attacker who successfully exploited this vulnerability could potentially execute scripts in the user’s browser to obtain information from web sessions.
CVE-2014-4070

Lync Denial of Service Vulnerability

A denial of service vulnerability exists in Lync Server. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding.
CVE-2014-4071

Bulletin details at Microsoft.com