Carding 4 Carders
Professional
The Microsoft team responsible for the mail server encourages you to update as soon as possible.
The Exchange team is asking administrators to install a new patch for a critical Microsoft Exchange Server vulnerability that was first fixed in August.
The vulnerability, identified as CVE-2023-21709 and patched in August this year as part of one of the past "patch Tuesdays", allows unauthorized attackers to increase their privileges on unprotected Exchange servers.
"In a network attack, an attacker can crack the passwords of a user's account to log in under this name. Microsoft encourages the use of strong passwords that are harder for an attacker to crack, " the company explained.
Despite the security updates released, Microsoft has also notified Exchange administrators that they need to manually exploit the vulnerable Windows IIS Token Cache module or use a special PowerShell script to protect their servers from attacks.
In the latest Patch Tuesday of October 10, Microsoft released a new security update ( CVE-2023-36434) that completely addresses the CVE-2023-21709 vulnerability without the need for additional actions.
"Today, the Windows team released a patch for IIS that addresses the root cause of this vulnerability," the Exchange team said.
Administrators who have previously removed the Windows IIS Token Cache module will now have to install the latest security updates, and then re-enable the IIS module using this command in PowerShell (with elevated rights).:
Those administrators who have not yet installed the August security update should definitely install the October Windows Server Security updates.
"We are making updates to all August 2023 — related documentation pages and scripts, as well as the health checker, to reflect our new recommendation," Microsoft added.
The latest security updates as part of Patch Tuesday or the so-called "patch Tuesday" for October this year fixed 104 vulnerabilities, of which 12 were rated as critical, and another 3 of them were marked as zero-day vulnerabilities that are actively used in real attacks.
It is noteworthy that Microsoft has refused to fix one of these critical flaws until today, the Skype for Business privilege Escalation vulnerability, tracked as CVE-2023-41763 and first disclosed more than a year ago, although attackers could have used it all this time to gain access to systems in internal networks.
The Exchange team is asking administrators to install a new patch for a critical Microsoft Exchange Server vulnerability that was first fixed in August.
The vulnerability, identified as CVE-2023-21709 and patched in August this year as part of one of the past "patch Tuesdays", allows unauthorized attackers to increase their privileges on unprotected Exchange servers.
"In a network attack, an attacker can crack the passwords of a user's account to log in under this name. Microsoft encourages the use of strong passwords that are harder for an attacker to crack, " the company explained.
Despite the security updates released, Microsoft has also notified Exchange administrators that they need to manually exploit the vulnerable Windows IIS Token Cache module or use a special PowerShell script to protect their servers from attacks.
In the latest Patch Tuesday of October 10, Microsoft released a new security update ( CVE-2023-36434) that completely addresses the CVE-2023-21709 vulnerability without the need for additional actions.
"Today, the Windows team released a patch for IIS that addresses the root cause of this vulnerability," the Exchange team said.
Administrators who have previously removed the Windows IIS Token Cache module will now have to install the latest security updates, and then re-enable the IIS module using this command in PowerShell (with elevated rights).:
Code:
New-WebGlobalModule -Name "TokenCacheModule" -Image "%windir%\System32\inetsrv\cachtokn.dll"Those administrators who have not yet installed the August security update should definitely install the October Windows Server Security updates.
"We are making updates to all August 2023 — related documentation pages and scripts, as well as the health checker, to reflect our new recommendation," Microsoft added.
The latest security updates as part of Patch Tuesday or the so-called "patch Tuesday" for October this year fixed 104 vulnerabilities, of which 12 were rated as critical, and another 3 of them were marked as zero-day vulnerabilities that are actively used in real attacks.
It is noteworthy that Microsoft has refused to fix one of these critical flaws until today, the Skype for Business privilege Escalation vulnerability, tracked as CVE-2023-41763 and first disclosed more than a year ago, although attackers could have used it all this time to gain access to systems in internal networks.
