#Microsoft lync 2011 for mac for mac
#Microsoft lync 2011 for mac install
#Microsoft lync 2011 for mac download
#Microsoft lync 2011 for mac windows

#Microsoft lync 2011 for mac for mac

In the Microsoft Lync for Mac 2011 Update volume window, double-click the Lync for Mac 2011 Update application to start the update process, and then follow the instructions on the screen.This step might have been performed for you. Double-click the file that you downloaded in step 5 to place the Microsoft Lync for Mac 2011 Update volume on your desktop, and then double-click the volume to open it.To check your preferences, on the Safari menu, click Preferences, and then click General. If you are using Safari, the downloaded file is saved to the desktop unless you specified a different location in the Preferences dialog box of Safari. Follow the instructions on the screen to save the file to your hard disk.Click Download, or click the link for the language version that you want.Make sure that your computer meets the minimum system requirements.Quit any applications that are running, including all Office applications, Microsoft Messenger, and Office Notifications, because they might interfere with the installation.Print this page if you want to use it as a reference when you are offline.It shows that the classic Top 10 OWASP finding - input sanitation - is still a problem for developers in shops of all sizes.

#Microsoft lync 2011 for mac windows

It’s interesting that both the Windows and Mac clients have had issues with input sanitation, despite the products being run by different teams. Since no user-interaction is required, the likelihood of execution is high. In the above scenario, against a user at an organization with open federation, an attacker could wait for their target to log in and force them to browse to a URL of their choosing. Get easy shells on high-value targets and the user doesn’t even have to click. At highest risk are those organizations that have Microsoft’s Federation enabled, allowing external entities to communicate with their users via Skype/Lync.Ī forced browsing exploit + browser or file-format exploit + open federation = super spear-phishing. However, paired with a browser or file format exploit, and the forced browsing becomes a terrific payload delivery method. While the default is to have it enabled, it’s a simple matter to fix by visiting the O365 Settings and whitelisting only the organizations that you wish to communicate with.įorced browsing isn’t a great exploit on its own. Second, please please please restrict your Microsoft Federation settings.

Especially in big Windows shops, where the only Macs might be a handful in the graphic design department, it’s easy for non-standard machines to fall through the cracks when it comes to patching and managing software. What can you do? First, make sure that if your organization uses Macs, that they are held to the same standard for vulnerability management. You should see a prompt appear on the target machine, and the URL should open in a new browser window!

#Microsoft lync 2011 for mac download

If you go to the Skype for Business 2016 Mac client download page you see that they recommend using the Lync 2011 client when connecting to Lync Server 2010. With that being said, if they don’t want to fix it, Microsoft should stop recommending it and remove it from their downloads page.

#Microsoft lync 2011 for mac install

Plus, it’s the Mac client, so the install base is likely on the smaller side. Lync: Mac 2011 is an aging client, with two product replacements out for it already (Skype for Business, and the new Microsoft Teams).

I’m not completely surprised by their decision not to fix the problem. The Microsoft Security Advisory can be found here:

September, 11 2018 – Microsoft discloses existence of vulnerability CVE-2018-8474.

July 2018 – Microsoft has decided they won’t be publishing fix after all.

May 2018 – Microsoft decides to fix it after all.

April 2018 – File with MITRE for CVE, MITRE contacts Microsoft.

March 2018 – Microsoft decides not to fix.

November 2017 – Microsoft has been able to replicate issue.

I reported this to Microsoft in July 2017 and the MSRC opened a ticket. Disclosure Timeline and Microsoft’s Response