Microsoft Skype for Business and Lync CVE-2018-8238 Security Feature Bypass Vulnerability

Description

A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages. An attacker who successfully exploited the vulnerability could execute arbitrary commands in the context of the logged-in user. The security feature bypass by itself does not allow arbitrary code execution. Instead, an attacker would have to convince users to click a link to a file.

Affected Applications

Microsoft Lync 2013 Service Pack 1 (32-bit)
Microsoft Lync 2013 Service Pack 1 (64-bit)
Skype for Business 2016 (32-bit)
Skype for Business 2016 (64-bit)

CVE References

Other References