Mitigation for Exchange Servers Hafnium Zero-day vulnerabilities

Posted by Zevenet | 18 March, 2021 | Technical

Even though it has been only a few months since the already famous attack on the SolarWinds supply chain, again we have to write about another hacking issue, this time related to Microsoft Exchange Server.

In this case, the Zero-day vulnerabilities found in Microsoft Exchange Server 2013, 2016, and 2019 permit an attacker to exploit them with impact to several organizations and businesses with on-premises Exchange Servers that enable access to email accounts and even installation of malware to allow long-term access to such servers. Microsoft detected the attacks from the Hafnium group, but also, others could have been using these 0-day exploits now that the attacks have been public.

These vulnerabilities have been registered and documented with the codes CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, and all of these have been addresses so urgent updates are strongly recommended to customers.

If you’re concerned about these attacks, we recommend implementing high availability solution plus a web application firewall in order to mitigate them, like the ZEVENET solution. If the Exchange Server update is not possible, Microsoft recommends implementing the following mitigations:

1. Trusted users mitigation: Access to the Microsoft Exchange Servers for trusted users only via VPN service.
2. Backend Cookie Mitigation: Implement a Web Application Firewall rule to filter the malicious HTTPS requests using X-AnonResource-Backend and malformed X-BEResource cookies in the headers used in the SSRF attacks.
3. Unified Messaging mitigation: Disable UM
4. Exchange Control Panel mitigation: Disable ECP VDir
5. Offline Address Book mitigation: Disable OAB VDir

At ZEVENET, we’ve been working to implement those very easily via the WAF module and brand new VPN services. Also, high availability, additional security, and load balancing for Exchange Servers can be implemented with ZEVENET:

https://www.zevenet.com/knowledge-base/howtos/high-availability-and-site-resilience-for-microsoft-exchange-2016-owa-cas-array-and-dag/

Don’t doubt to contact us to have more details on how to implement those mitigations!

Official info related to these Microsoft vulnerabilities:

https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/

SHARE ON:

Related Blogs

Posted by zenweb | 11 October 2021
5G holds a lot of potential for businesses. The promise of speeds up to 20 Gbps and near-zero latency could help companies become faster and more connected than ever. Despite…
4 LikesComments Off on How 5G Is Changing the Cybersecurity Landscape
Posted by zenweb | 30 September 2021
Are you facing issues in working remotely? Do you need the right tool to manage your remote workforce? Over a decade has passed and business desktops have evolved ever since.…
7 LikesComments Off on Which Is Best When Working Remotely: VDI or DaaS
Posted by zenweb | 22 September 2021
We have recently witnessed a growing number of cyber-crimes prevailing in industries worldwide. While most regulatory and governing bodies are stepping up to prevent such incidents, it is yet evident…
10 LikesComments Off on 10 Importance of Information Security Audit