Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker.
What Customers Should Do
To protect your on-prem Exchange you can bind a responder policy on the Citrix ADC contentswitch handling all the Exchange related traffic:
Vulnerabilities have been discovered in Citrix Application Delivery Management (Citrix ADM) that, if exploited, could result in the following security issues:
Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted.
Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
CVE-ID
Description
CWE
Pre-conditions
CVE-2022-27511
Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password
CWE-284: Improper Access Control
Access to ADM IP
CVE-2022-27512
Temporary disruption of the ADM license service
CWE-664: Improper Control of a Resource Through its Lifetime
Access to ADM IP
Da der ADM Zugangsdaten & Zugriff auf die konfigurierten Instanzen hat, wird empfohlen die Sicherheitslücke rasch zu schliessen in dem die ADM Instanz auf eine der folgenden Versionen aktualisiert wird:
Citrix ADM 13.1-21.53 and later versions of 13.1
Citrix ADM 13.0-85.19 and later versions of 13.0
Als Mitigation kann versucht werden die ADM Management IP über eine Firewall zu sperren.
Normalerweise ist das ADM nur von intern zugänglich wodurch das Risiko einer Ausnutzung der Schwachstelle relativ klein ist. Ein Angreifer müsste bereits Zugang zum internen Netz haben. Wie die Schwachstelle ausgenutzt werden kann ist bisher unbekannt.
Für detaillierte Informationen und weitere Schritte, folgen Sie bitte den Informationen im Original Citrix Artikel. Gerne unterstützen wir Sie bei bedarf bei dem Update.
A vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows). If exploited, this issue would allow an adversary, who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM. This issue has the following identifier:
CVE-ID
Description
CWE
Pre-conditions
CVE-2022-21827
Arbitrary corruption or deletion of files as SYSTEM
CWE-284: Improper Access Control
Local access to a machine that has the vulnerable plug-in installed
The following supported versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) are affected by this vulnerability:
Citrix Gateway Plug-in for Windows versions before 21.9.1.2
What Customers Should Do
This issue has been addressed in the following versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows):
Citrix Gateway Plug-in for Windows version 21.9.1.2 and later releases
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry’s standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.
Proböembeschreibung
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry’s standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.
Betroffene Systeme
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry’s standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.
Lösung
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry’s standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.
Seit dem 01.01.2022 – 00:00 Uhr werden aufgrund eines Bugs bei On-Prem Exchange Servern keine Mails mehr zugestellt. Neue Mails werden vom Exchange zwar angenommen, bleiben dann aber in der Submission Queue hängen und werden nicht ausgeliefert.
Ursache ist ein Bug im “Microsoft Filtering Management Service”, der sich am Jahr 2022 verschluckt. Im Application Event log finden sich dann viele Fehlermeldungen des FIPFS Services mit Meldungen wie «Cannot convert “220101001” to long»
Als Quick Fix reicht es, den «AntiMalware Scanning Service» temporär via Disable-Antimalwarescanning.ps1zu disablen.
In dem Beitrag findet sich etwas versteckt ein Download Link für ein PowerShell Script, welches diesen Prozess automatisiert: https://aka.ms/ResetScanEngineVersion
Das Script läuft recht lange (bis zu 30 Min.) Anschliessend musste der «Microsoft Exchange Transport» Service neu gestartet werden, um den Mailfluss wieder in Gang zu bringen.
