Kaspersky LabKLA11518KLA11518 Multiple vulnerabilities in Microsoft Exchange Server
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5.1 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
76.8%
Detect date:
07/09/2019
Severity:
High
Description:
Multiple vulnerabilities were found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges, obtain sensitive information.
Affected products:
Microsoft Exchange Server 2016 Cumulative Update 13
Microsoft Exchange Server 2019 Cumulative Update 1
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 2
Microsoft Exchange Server 2016 Cumulative Update 12
Microsoft Exchange Server 2010 Service Pack 3
Microsoft Office 2016 (32-bit edition)
Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
Microsoft Lync Basic 2013 Service Pack 1 (64-bit)
Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
Skype for Business 2016 (64-bit)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2016 for Mac
Skype for Business 2016 (32-bit)
Microsoft Office 2019 for Mac
Microsoft Lync Basic 2013 Service Pack 1 (32-bit)
Outlook for iOS
Microsoft Outlook 2016 (64-bit edition)
Microsoft Outlook 2010 Service Pack 2 (64-bit editions)
Microsoft Lync 2013 Service Pack 1 (32-bit)
Office 365 ProPlus for 32-bit Systems
Microsoft Outlook 2016 (32-bit edition)
Microsoft Outlook 2010 Service Pack 2 (32-bit editions)
Mail and Calendar
Microsoft Outlook for Android
Office 365 ProPlus for 64-bit Systems
Microsoft Lync 2013 Service Pack 1 (64-bit)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2019 for 64-bit editions
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Skype for Business 2016 Basic (64-bit)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Skype for Business 2016 Basic (32-bit)
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2019-1137
CVE-2019-1136
CVE-2019-1084
ADV190021
Impacts:
OSI
Related products:
CVE-IDS:
CVE-2019-10844.0Warning
CVE-2019-11373.5Warning
CVE-2019-11365.1High
KB list:
Microsoft official advisories:
References
support.microsoft.com/kb/4509408
support.microsoft.com/kb/4509409
support.microsoft.com/kb/4509410
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1084
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1136
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1137
portal.msrc.microsoft.com/en-us/security-guidance
portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190021
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1084
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1136
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1137
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/product/Microsoft-Exchange-Server/
Related
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5.1 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
76.8%