Microsoft Defender Antivirus Now Automatically Mitigates Exchange Server Vulnerabilities (zdnet.com) 19
"Microsoft has implemented an automatic mitigation tool within Defender Antivirus to tackle critical vulnerabilities in Exchange Server," reports ZDNet:
On March 18, the Redmond giant said the software will automatically mitigate CVE-2021-26855, a severe vulnerability that is being actively exploited in the wild. This vulnerability is one of four that can be used in a wider attack chain to compromise on-premise Exchange servers.
Microsoft released emergency fixes for the security flaws on March 2 and warned that a state-sponsored threat group called Hafnium was actively exploiting the bugs, and since then, tens of thousands of organizations are suspected to have been attacked. At least 10 other advanced persistent threat (APT) groups have jumped on the opportunity slow or fragmented patching has provided.
The implementation of a recent security intelligence update for Microsoft Defender Antivirus and System Center Endpoint Protection means that mitigations will be applied on vulnerable Exchange servers when the software is deployed, without any further input from users. According to the firm, Microsoft Defender Antivirus will automatically identify if a server is vulnerable and apply the mitigation fix once per machine.
The article also points out Microsoft also released a one-click mitigation tool earlier this week, which is "still readily available as an alternative way to mitigate risk to vulnerable servers if IT admins do not have Defender Antivirus."
Microsoft released emergency fixes for the security flaws on March 2 and warned that a state-sponsored threat group called Hafnium was actively exploiting the bugs, and since then, tens of thousands of organizations are suspected to have been attacked. At least 10 other advanced persistent threat (APT) groups have jumped on the opportunity slow or fragmented patching has provided.
The implementation of a recent security intelligence update for Microsoft Defender Antivirus and System Center Endpoint Protection means that mitigations will be applied on vulnerable Exchange servers when the software is deployed, without any further input from users. According to the firm, Microsoft Defender Antivirus will automatically identify if a server is vulnerable and apply the mitigation fix once per machine.
The article also points out Microsoft also released a one-click mitigation tool earlier this week, which is "still readily available as an alternative way to mitigate risk to vulnerable servers if IT admins do not have Defender Antivirus."
Too late? (Score:3)
Re: (Score:3)
The ones that crashed too often for the exploit to complete running, maybe?
In other news, guess what also mitigates it? (Score:1)
Postfix / Dovecot
Far more secure, far more reliable, and far cheaper.
Also happens to be fully SMTP and IMAP compliant.
Re:In other news, guess what also mitigates it? (Score:4, Interesting)
Re: (Score:2)
The problem is not that any server has bugs, it's the fact that it seems that Exchange is so broken that they can't fix it and need to use software outside of the server subsystem shield the server from the exploit. That is sort of like having a hole in your tire, and you solve it by adding an air pump that continuously inflates the tire to mitigate the hole rather than fixing the tire.
Oh, and by the way, there are a number of Linux Distros that will automatically install security patches, and virtually *al
Re: In other news, guess what also mitigates it? (Score:2)
They _do_ have a system for deploying security fixes. Itâ(TM)s called windows defenter. :facepalm:
Re: (Score:1)
Re: (Score:2)
Far more secure
Anyone saying that tend to automatically lose credibility.
He wo hitte, shiri tsubome (Score:3, Funny)
Why aren't we getting mail? (Score:3, Interesting)
Oh, because Defender automatically disabled things Exchange needs to operate properly becuase they've been classed as "vulnerabilities"!
typical (Score:2)
so, instead of doing something about the root causes (shoddy software that has too many priviledges), they are using this to push another product in order to take hold of another market (AV software) ?
So typical. MS doesn't change.
Re: (Score:2)
The market for AV software was one Microsoft created originally with their swiss cheese software. And frankly, it sucked, AV products were either intrusive and resource draining or they were ineffective, and often both.
IMHO, Microsoft "taking hold" of the AV market has the upside that Microsoft now is dealing internally with their own security issues and it might lead down the line to their software generally being more secure, since its in their best interest to need less AV mitigation.
Re: (Score:2)
I would give something for such naive views of the world, it's probably easier and more comfortable.
If MS wanted to deal with security issues internally, they've had plenty of time, enough ressources to do it and several major OS releases to roll it out. The fact that they didn't means they are either incompetent, unwilling, or both.
Scalping the AV market with their own solution is a bit like a car company selling cars with shitty tires for twenty years and then when a well-established tire market has devel
Re: (Score:2)
Security in the computer industry as a whole has been a running trainwreck for 30 years. Microsoft has always prioritized backwards compatibility over pretty much everything else, except the last 5-10 years when they tried to mimic Apple with their mobile ambitions and touch-oriented UI overhaul.
Plus they've more or less been a monopoly (or close enough) that responsiveness to security hasn't been significant enough to move the needle on actual security improvements. And its not like their customers aband
Simple Question (Score:2)
How can a piece of code nearly as old as MS-DOS itself still have enough unpatched vulnerabilities after all these years serious enough that it requires even more potentially-vulnerable code to âoeautomatically mitigateâ even more presumably unknown vulnerabilities in the âoemonitoredâ code?
Amazing, Microsoft ! (Score:1)