CVE-2019-1084
Description
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft exchange_server | 2010, 2013, 2016 | — |
| microsoft lync | 2013 | — |
| microsoft lync_basic | 2013 | — |
| microsoft mail_and_calendar | No range specified | — |
| microsoft office | 2010, 2013, 2016, 2019 | — |
| microsoft office_365_proplus | No range specified | — |
| microsoft outlook | No range specified, 2013, 2016 | — |
| microsoft skype_for_business | 2016 | — |
| microsoft skype_for_business_basic | 2016 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.