Alert GCSA-21022 - Microsoft out-of-band Security Update per Exchange Server

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

******************************************************************

   alert ID: GCSA-21022
       data: 03 marzo 2021
     titolo: Microsoft out-of-band Security Update per Exchange Server

******************************************************************

:: Descrizione del problema

   Microsoft ha rilasciato degli aggiornamenti di sicurezza non programmati,
   per risolvere sette vulnerabilita' presenti in Microsoft Exchange Server.

   Quattro di queste vulnerabilita' sono di tipo zero-day, cioe' sono
   in corso di sfruttamento. Anche se Microsoft afferma che gli attacchi
   sono mirati e limitati si consiglia di applicare le patch il prima
   possibile.

   Le vulnerabilita' consentono l'esecuzione di codice arbitrario da remoto.

   Maggiori dettagli sono disponibili nella segnalazione ufficiale
   alla sezione "Riferimenti".


:: Software interessato

   Microsoft Exchange Server 2013
   Microsoft Exchange Server 2016
   Microsoft Exchange Server 2019


:: Impatto

   Esecuzione remota di codice arbitrario (RCE)
   Bypass delle funzionalita' di sicurezza (SFB)
   Data Manipulation (Tampering)


:: Soluzioni

   Si consiglia di aggiornare il software alla versione
   piu' recente. Gli aggiornamenti sono disponibili tramite

   Method 1: Microsoft Update

   Method 2: Microsoft Update Catalog
   https://www.catalog.update.microsoft.com/Search.aspx?q=KB5000871

   Method 3: Microsoft Download Center

   Exchange Server 2010 (RU 31 for Service Pack 3 . this is a Defense in Depth update)
   https://url.garrlab.it/gswsg

   Exchange Server 2013 (CU 23)
   https://url.garrlab.it/689pj

   Exchange Server 2016 (CU 19, CU 18)
   https://url.garrlab.it/689pj

   Exchange Server 2019 (CU 8, CU 7)
   https://url.garrlab.it/689pj


:: Riferimenti

   Multiple Security Updates Released for Exchange Server
   https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/

   HAFNIUM targeting Exchange Servers with 0-day exploits
   https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

   March 2021 Exchange Server Security Updates
   https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901

   Microsoft Exchange Server Remote Code Execution Vulnerability
   CVE-2021-26412
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26412

   Microsoft Exchange Server Remote Code Execution Vulnerability
   CVE-2021-26855
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855

   Microsoft Exchange Server Remote Code Execution Vulnerability
   CVE-2021-27065
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065

   Microsoft Exchange Server Remote Code Execution Vulnerability
   CVE-2021-26857
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857

   Microsoft Exchange Server Remote Code Execution Vulnerability
   CVE-2021-27078
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27078

   Microsoft Exchange Server Remote Code Execution Vulnerability
   CVE-2021-26854
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26854

   Microsoft Exchange Server Remote Code Execution Vulnerability
   CVE-2021-26858
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858

   Microsoft - New nation-state cyberattacks
   https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/

   Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities
   https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

   Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails
   https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/

   Microsoft issues emergency patches for 4 exploited 0-days in Exchange
   https://arstechnica.com/information-technology/2021/03/microsoft-issues-emergency-patches-for-4-exploited-0days-in-exchange/

   Microsoft: 4 Exchange Server Zero-Days Under Attack by Chinese Hacking Group
   https://www.securityweek.com/microsoft-4-exchange-server-zero-days-under-attack-chinese-apt-group

   URGENT . 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange
   https://thehackernews.com/2021/03/urgent-4-actively-exploited-0-day-flaws.html


GARR CERT Security Alert -  subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert

-----BEGIN PGP SIGNATURE-----

iFwEARECAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCYD9ZVgAKCRDBnEyTZRJg
QgxgAJjoz8zHMLWD97UUW9xp2Ke80LkHAJ905L3R7+O0eOy59SJyZ5F1DN1MDw==
=ME9c
-----END PGP SIGNATURE-----