By TechThop Team
Posted on: 10 Aug, 2022
Microsoft has claimed that some of the Exchange Server addressed as part of the August 2022 Patch Tuesday will also require admins to manually enable Extended Protection on affected servers to fully block attacks.
The company Microsoft also patched 121 flaws today, including the DogWalk Windows zero-day exploited in the wild and several Exchange vulnerabilities which were rated as a critical severity and allowed for privilege escalation.
Through the use of phishing emails or chat messages, remote attackers can use these Exchange bugs to escalate privileges in low-complexity attacks by dumping their targets into accessing a malicious server.
The Exchange Server Team warned the users by saying that although we are not aware of any active exploits in the wild, they recommend immediately installing the updates to protect the environment.
To ensure that threat actors can't access vulnerable servers, Microsoft advises administrators to set Extended Protection (EP) after installing today's security upgrades.
The functionality of the Windows Server is improved by the EP feature to lessen authentication relay or mediator attacks.
The company has recommended that the customers who are more vulnerable to this kind of attack should enable Extended Protection to prevent this attack from happening.
The company also asked the customers to note that enabling Extended Protection (EP) is only supported on specific versions of Exchange.
A script provided by Microsoft is available to enable this feature, but admins are advised to carefully evaluate their environments and review the issues mentioned in the script documentation before toggling it on their Exchange servers.
Microsoft has issued security updates for multiple Exchange Server builds which include Exchange Server 2013 CU23, Exchange Server 2016 CU22 and CU23, Exchange Server 2019 CU11 and CU12
Since Redmond has also tagged all three Exchange vulnerabilities as Exploitation More Likely, admins should patch these flaws as soon as possible.
For more stories like this
Explore our website