Mitigation for Exchange Servers Hafnium Zero-day vulnerabilities

Posted by Zevenet | 18 March, 2021 | Technical

Even though it has been only a few months since the already famous attack on the SolarWinds supply chain, again we have to write about another hacking issue, this time related to Microsoft Exchange Server.

In this case, the Zero-day vulnerabilities found in Microsoft Exchange Server 2013, 2016, and 2019 permit an attacker to exploit them with impact to several organizations and businesses with on-premises Exchange Servers that enable access to email accounts and even installation of malware to allow long-term access to such servers. Microsoft detected the attacks from the Hafnium group, but also, others could have been using these 0-day exploits now that the attacks have been public.

These vulnerabilities have been registered and documented with the codes CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, and all of these have been addresses so urgent updates are strongly recommended to customers.

If you’re concerned about these attacks, we recommend implementing high availability solution plus a web application firewall in order to mitigate them, like the ZEVENET solution. If the Exchange Server update is not possible, Microsoft recommends implementing the following mitigations:

1. Trusted users mitigation: Access to the Microsoft Exchange Servers for trusted users only via VPN service.
2. Backend Cookie Mitigation: Implement a Web Application Firewall rule to filter the malicious HTTPS requests using X-AnonResource-Backend and malformed X-BEResource cookies in the headers used in the SSRF attacks.
3. Unified Messaging mitigation: Disable UM
4. Exchange Control Panel mitigation: Disable ECP VDir
5. Offline Address Book mitigation: Disable OAB VDir

At ZEVENET, we’ve been working to implement those very easily via the WAF module and brand new VPN services. Also, high availability, additional security, and load balancing for Exchange Servers can be implemented with ZEVENET:

https://www.zevenet.com/knowledge-base/howtos/high-availability-and-site-resilience-for-microsoft-exchange-2016-owa-cas-array-and-dag/

Don’t doubt to contact us to have more details on how to implement those mitigations!

Official info related to these Microsoft vulnerabilities:

https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/

SHARE ON:

Related Blogs

Posted by zenweb | 23 March 2021
The world of the internet is full of people waiting to breach into your system. They want to get a grasp of your personal information and exploit it. This might…
8 LikesComments Off on Importance of Cybersecurity for Businesses
Posted by zenweb | 11 March 2021
Find out what IPsec and IPsec tunnel mode is? When do you need it? How does it work? Do VPNs use IPsec? And protect your data today! There is an…
12 LikesComments Off on Understanding VPN IPSec Modes
Posted by zenweb | 16 February 2021
Networking is always facing new challenges and threats and it becomes more and more vital to manage the safest and most accurate tools to provide all the security needed. As…
21 LikesComments Off on ZEVENET continuously defeating vulnerabilities!