Category: Microsoft|Apr 5, 2021 | Author: Admin

Microsoft provides Exchange Server defensive tool to help SMBs stymie zero-day attacks

Share on

The one-click tool is intended as a stopgap measure to protect vulnerable on-premises Exchange servers, deployed mainly by small and midsize businesses.

Microsoft Tuesday issued instructions and a one-click tool to small businesses with on-premises Exchange servers to patch the vulnerability first disclosed by the company on March 2, and which criminals have been using to spy on victims' communications as well as gain access to other parts of their networks.

"We realized that there was a need for a simple, easy to use, automated solution that would meet the needs of customers using both current and out-of-support versions of on-premises Exchange Server," Microsoft said in a post to a company blog attributed to the MSRC (Microsoft Security Research Center) Team.

The tool, dubbed (with the usual Microsoft knack of catchy monikers), "Microsoft Exchange On-Premises Mitigation Tool," is aimed at customers that don't have dedicated IT personnel or are even "unfamiliar," Microsoft said, with the patching and update process. The tool works on Exchange 2013, 2016, and 2019, the currently supported editions of the server software. (Exchange 2013 will be supported until April 2023, while the other two editions will be supported until October 2025.)

According to Microsoft, the tool is "not a replacement for the Exchange security update," but a stopgap measure to defend vulnerable Exchange servers until the customer can deploy the actual fix.

The tool does several things, notably configuring Exchange Server to institute mitigation for the CVE-2021-26855 vulnerability (one of four now being exploited by cybercriminals). The tool also runs a malware scan using "Microsoft Safety Scan," a free utility that both sniffs out exploits and attempts to reverse any changes made by attackers. (The scanner, which can also be manually downloaded from here, is live for the following 10 days. Users can trigger it for additional scans at any time after the mitigation through that stretch.)

This was not the first automated script Microsoft has offered customers to mitigate against attacks based on the Exchange Server bugs patched on March 2. Three days after that, Microsoft posted links to multiple mitigation tools, including "ExchangeMitigations.ps1," a PowerShell script that tackled several of the patched vulnerabilities, including CVE-2021-26855, which was also addressed by the newer On-Premises Mitigation Tool.


"We recommend this script over the previous ExchangeMitigations.ps1 script as it [is] tuned based on the latest threat intelligence," Microsoft said Tuesday. "If you have already started with the other script, it is fine to switch to this one."

The Exchange Server vulnerabilities were patched March 2 in one of Microsoft's rare out-of-band updates, meaning the update was released outside the usual second-Tuesday-of-each-month schedule.


Microsoft's best source of information on the vulnerabilities and the exploits them can be found in a security blog post on the Exchange Server attacks.

The attacks quickly jumped from those against the largest organizations to a larger pool of victims as the number of bad actors behind them expanded, that unusual in itself.

Additional guidance for those responsible for maintaining the security of Exchange Server software can be found in a March 16 post to the MSRC blog.

Sponsored Ads:

Comments:


Microsoft says recent Windows 11 updates break SSH connections

Category: Microsoft|Nov 11, 2024 | Author: Admin

Mislabeled patch sends Windows Server 2022 admins on unwanted upgrade to 2025

Category: Microsoft|Nov 10, 2024 | Author: Admin

Malicious PyPI package with 37,000 downloads steals AWS keys

Category: IT|Nov 9, 2024 | Author: Admin

Canada orders TikTok to shut down over national risk concerns

Category: IT|Nov 8, 2024 | Author: Admin

Windows infected with backdoored Linux VMs in new phishing attacks

Category: Microsoft|Nov 7, 2024 | Author: Admin

After signal loss, Voyager 1 reconnected with Earth using retro transmitter not used since 1981

Category: IT|Nov 6, 2024 | Author: Admin

Massive PSAUX ransomware attack targets 22,000 CyberPanel instances

Category: IT|Nov 5, 2024 | Author: Admin

Microsoft delays Windows Recall again, now by December

Category: Microsoft|Nov 4, 2024 | Author: Admin

The new Nothing Phone (2a) Plus Community Edition is here to illuminate your night

Category: IT|Nov 3, 2024 | Author: Admin

DDoS site Dstat.cc seized and two suspects arrested in Germany

Category: IT|Nov 2, 2024 | Author: Admin

Windows 11 is getting more popular, climbs over 35.5% market share

Category: Microsoft|Nov 1, 2024 | Author: Admin

qBittorrent fixes flaw exposing users to MitM attacks for 14 years

Category: IT|Oct 31, 2024 | Author: Admin

Microsoft Entra "security defaults" to make MFA setup mandatory

Category: Microsoft|Oct 30, 2024 | Author: Admin

CyberPanel Urges Users to Upgrade Amid Ongoing Issues

Category: IT|Oct 29, 2024 | Author: Admin

US says Chinese hackers breached multiple telecom providers

Category: IT|Oct 28, 2024 | Author: Admin
more