SB2013051501 - Permissions, Privileges, and Access Controls in Microsoft Windows Essentials

Description

This security bulletin contains information about 1 security vulnerability.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-0096)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability." Per: http://technet.microsoft.com/en-us/security/bulletin/ms13-045 'There is no update available for Windows Essentials 2011. See update FAQ for details.'

Remediation

Install update from vendor's website.

References

• http://www.us-cert.gov/ncas/alerts/TA13-134A
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-045
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16204