Security Advisory - November 5, 2013
Zscaler Protects Against Vulnerability in Microsoft Office/Lync allows Arbitrary Code Execution
Zscaler, working with Microsoft through their MAPPs program has proactively deployed protections for the following vulnerability included in the November 5, 2013 Microsoft security bulletin. Zscaler will continue to monitor exploits associated with this vulnerability and release and deploy additional protections as necessary.
MSA-2896666 – Vulnerability in Microsoft Office Could Allow Remote Code Execution
- Microsoft Word 2003
- Microsoft Word 2007
- Microsoft Word 2010
CVE-2013-3906 – Remote Code Execution Vulnerability in Microsoft Office and Lync
Description: The vulnerability exists in the way that Microsoft Office and Lync accesses a specifically crafted TIFF image within a Word file. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Windows XP or Windows Server 2003. An attacker could host a specially crafted Word Document that is designed to exploit this vulnerability through Microsoft Word or crash the program.