HAFNIUM: EOMT from Microsoft secures unpatched Exchange Server

by

Microsoft provides the tool "Exchange On-premises Mitigation Tool (EOMT) to secure unpatched Exchange servers for download: https://github.com/microsoft/CSS-Exchange/tree/main/Security EOMT first secures the Exchange server against the vulnerability CVE-2021-26855 using URL rewrite and then downloads the Microsoft Safty Scanner to check the server for a successful attack. However, EOMT does not install the available updates ... Read more

HAFNIUM: Changed directory permissions prevent update

by

In the case of successfully attacked Exchange servers with the HAFNIUM exploit, the directory permissions may be changed, resulting in affected Exchange servers reporting an error message when installing updates. Here is an example of a directory where the permissions have been changed: As can be seen in the screenshot, the permissions for the principal ... Read more

HAFNIUM: Small update on the public exploit

by

The exploit for the Exchange vulnerabilities is now publicly available and, as was to be expected, is spreading even further. Initially, the exploit was blocked on GitHub, which naturally resulted in the exploit being published on various sites. In the meantime, the exploit is also available again on GitHub, only on other ... Read more

HAFNIUM exploit: Microsoft releases updates for older Exchange versions

by

Due to the severity of the HAFNIUM exploit, Microsoft has released further updates for older Exchange Server versions. However, the updates cannot be obtained via Windows Update, but must be downloaded and installed manually. Further information on the updates can be found here: March 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server Some ... Read more

Exchange Server: Reinstallation without data loss (e.g. after an attack)

by

Many admins are currently reporting a successful attack on their Exchange server. Many are finding evidence of unauthorized access or even an installed web shell. Many are now unsure what to do or how to proceed. Some are now implementing IIS rewrite rules or deactivating the UM services, for example, as described in this article by ... Read more

Exchange Server: New security updates (March 2021)

by

Microsoft has released new security updates for Exchange Server 2013, 2016 and 2019. The prompt installation of the security updates for the affected Exchange versions is recommended by Microsoft, as the vulnerabilities are already being exploited: As active exploitation of related vulnerabilities in the wild is known (limited targeted attacks), our recommendation is to install these updates immediately to prevent ... Read more