What is CVE-2017-8550?

CVE-2017-8550 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Skype for Business Remote Code Execution Vulnerability

Which CVE IDs does CVE-2017-8550 cover?

CVE-2017-8550 covers the following CVE IDs: CVE-2017-8550. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2017-8550?

CVE-2017-8550 affects 2 products, including: Microsoft Office 2016 Click-to-Run (C2R) for 32-bit editions; Microsoft Office 2016 Click-to-Run (C2R) for 64-bit editions.

CVE-2017-8550High

Skype for Business Remote Code Execution Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

June 13, 2017

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2017-8550 →

📋 Description

A remote code execution vulnerability exists when Skype for Business and Microsoft Lync Servers fail to properly sanitize specially crafted content. An authenticated attacker who successfully exploited this vulnerability could execute HTML and JavaScript content in the Skype for Business or Lync context. An attacker could use this vulnerability to open a web page using the default browser, open another messaging session with someone else, or potentially trigger other URIs defined on the client’s system for another application. To exploit this vulnerability an attacker could invite a user to an instant message session and then send a message that contains specially crafted JavaScript content. The update addresses the vulnerability by correcting how Skype for Business and Lync Servers sanitize content.

🎯 Affected products2

Microsoft Office 2016 Click-to-Run (C2R) for 32-bit editions
Microsoft Office 2016 Click-to-Run (C2R) for 64-bit editions

✅ Remediation

KBClick to Run (Security Update)

🔗 References (1)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-8550