Exchange 2016/2019: Critical patches against 2020 exploits

 

Introduction

Exchange Admins don't always like patching and they say: "well it's working so why fix something that ain't broken."

Well, if you are on a CU earlier than CU15, you should really consider upgrading.

CU14 and CU15 have a number of fixes in them but not only that, you need to apply the security patches after you upgrade to CU15 on Exchange 2016 and CU4 on Exchange 2019.

Patch for CVE-2020-0903

Issue: CVE-2020-0903 | Microsoft Exchange Server Spoofing Vulnerability

The first patch is this one, here is a description:

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected server.

The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the Exchange server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.

The security update addresses the vulnerability by helping to ensure that Exchange Server properly sanitizes web requests.

Download

https://support.microsoft.com/en-us/help/4540123/security-update-for-exchange-server-2019-and-2016

KB4536987

The second one is, here is a brief description:

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. An attacker could then install programs; view, change, or delete data; or create new accounts.

Download 2

https://www.microsoft.com/en-us/download/details.aspx?id=100908

Please upgrade to avoid getting your servers exploited.