NEW MICROSOFT EXCHANGE SERVER VULNERABILITIESÂ
Microsoft released patches yesterday to address new “zero-day” vulnerabilities. Just one month after the ProxyLogin vulnerability, Exchange Server versions 2013, 2016, and 2019 are once again affected by critical vulnerabilities. These vulnerabilities could allow an attacker to take control of the Exchange server and potentially the Active Directory domain.
What Are the Risks to Your Business?
The full extent of the potential consequences of these vulnerabilities is not yet known. However, hacker groups may already be exploiting these vulnerabilities.
These vulnerabilities allow an attacker to execute code remotely and, ultimately, gain Active Directory domain administrator privileges. The attacker could then steal confidential data, deploy ransomware, or destroy the internal network.
How to protect yourself against it?
One initial step is to restrict unauthorized connections to port 443 or to configure a VPN to isolate the Exchange server from external access.
As with the most recent reported Exchange vulnerability, we also recommend that you:
- Immediately disconnect any Exchange servers that are exposed to the Internet without protection
- Apply the security patches provided by the vendor to all Exchange servers (both those exposed to the Internet and internal ones)
- In the event of a compromise, monitor the information system to detect any lateral movement as well as a compromise of the Active Directory servers.
- Scan your network regularly. Tools like IKare, available as a free trial, automate the monitoring of your IT system.
- Do not leave servers exposed and unprotected. ITrust offers tools to detect cyber threats, ransomware, viruses, and abnormal behavior within your IT system, such as our SIEM Reveelium UEBA.
>> See the list of fixes on the Microsoft blog.
If you need assistance in remediating these vulnerabilities, contact us:
>Â +33 (0)5 67 34 67 80
>Â contact@itrust.fr
*Sources:NSA –msrc-blog.microsoft.com
