MS15-104: Vulnerabilities in Skype for Business Server and Lync Server could allow elevation of privilege: September 8, 2015

Summary
This security update resolves vulnerabilities in Skype for Business and Microsoft Lync Server. The most severe of these vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL. An attacker would have to convince users to click a link in an instant messenger or email message that directs them to an affected website by way of a specially crafted URL. To learn more about the vulnerability, see Microsoft Security Bulletin MS15-104.
More information about this security update
The following articles contain more information about this security update as it relates to individual product versions. The articles may contain known issue information.
More information

Security update deployment information

Microsoft Lync Server 2013

Reference table
The following table contains the security update information for this software.
Security update file nameFor Microsoft Lync Server 2013 (3080353):
WebComponents.msp
Installation switchesSee Microsoft Knowledge Base Article 197147
Restart requirementThis update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, you receive a message that advises you to restart.
Removal informationUse Add or Remove Programs item in Control Panel.
File informationSee Microsoft Knowledge Base Article 3080353.
Registry key verificationFor Microsoft Lync Server 2013 (WebComponents.msp):

HKLM\Software\Microsoft\Real-Time Communications\{2A65AB9C-57AD-4EC6-BD4E-BD61A7C583B3}\Version = 5.0.8308.927

Skype for Business Server 2015

Reference table
The following table contains the security update information for this software.
Security update file nameFor Skype for Business Server 2015 (3080355):
WebComponents.msp
For Skype for Business Server 2015 (3080352):
EnterpriseWebApp.msp
Installation switchesSee Microsoft Knowledge Base Article 197147
Restart requirementThis update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, you receive a message that advises you to restart.
Removal informationSee Microsoft Knowledge Base Article 3061064
File informationSee Microsoft Knowledge Base Article 3080355.
See Microsoft Knowledge Base Article 3080352.
Registry key verificationFor Skype for Business Server 2015 (WebComponents.msp):

HKEY_LOCAL_MACHINE\Software\Microsoft\Real-Time Communications\{2A65AB9C-57AD-4EC6-BD4E-BD61A7C583B3}\Version = 6.0.9319.72
For Skype for Business Server 2015 (EnterpriseWebApp.msp):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F055581A89591B9409A70EFBF5EB7DE7\InstallProperties = 6.0.9319.72

File hash information

Package NamePackage Hash SHA 1Package Hash SHA 2
EnterpriseWebApp_2015_en_us_x64.msp4E2196C6EAD919109E179361058C4EB79752FE981747EBE41F7E90CE60E3929AFC020E6F0117455DF9F945B9D55293F2919C5117
WebComponents_2015_en-us_x64.msp5AE12FEA75F5031C3F85065D542379952DF83AC00BF98F955B10DDEF028C4ECF0DDB05CDFEB0F7A13AC6214D545684696EFA46DB
WebComponents_Lync2013_en-us_x64.msp1067898A33AC2DCCB4843570B37159C99A0D40C5F48003AA5C04F2418F6390D67B3E4111E93D78D2DF28342A41F9171A799EA05A
EnterpriseWebApp.mspC9586471881CCBC3F9318654185B99F38E502C5B3DEAB025280379CD49069A7F818DB9CFAB472BB693E15FA11256F0E00AE7F4A5
WebComponents.msp27EFC31A1C885E1884A77FA6788715ADBB913F09C8C7024A81FC4F039A51BEAC6660217B6D3A8E6D94D4636370C1730A62AB9EFD

How to obtain help and support for this security update

Help for installing updates: Support for Microsoft Update

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

Help for protecting your Windows-based computer from viruses and malware: Virus Solution and Security Center

Local support according to your country: International Support
update security_patch security_update security bug flaw vulnerability malicious attacker exploit registry unauthenticated buffer overrun overflow specially-formed scope specially-crafted denial of service DoS TSE
Properties

Article ID: 3089952 - Last Review: 09/18/2015 03:42:00 - Revision: 4.0

Skype for Business Server 2015, Microsoft Lync Server 2013

  • kbexpertiseinter kbsecurity kbsecbulletin kbsecvulnerability kbbug kbfix kbsurveynew atdownload KB3089952
Feedback