KLA11242 Multiple vulnerabilities in Microsoft Exchange Server

Multiple serious vulnerabilities have been found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information and spoof user interface.

Below is a complete list of vulnerabilities:

1. An improper handling of objects in memory in Microsoft Exchange can be exploited remotely via a specially designed e-mail to obtain sensitive information;
2. Multiple vulnerabilities in Microsoft Exchange Outlook Web Access (OWA) can be exploited remotely via a specially designed website to gain privileges or spoof user interface;
3. Memory corruption vulnerability in Microsoft Exchange software can be exploited remotely via a specially designed e-mail to execute arbitrary code;

Original advisories

CVE-2018-8152

CVE-2018-8153

CVE-2018-8151

CVE-2018-8154

CVE-2018-8159

Related products

Microsoft-Exchange-Server

CVE list

CVE-2018-8152 high

CVE-2018-8153 high

CVE-2018-8151 warning

CVE-2018-8154 critical

CVE-2018-8159 high

KB list

4091243

4092041

4458321

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 21Microsoft Exchange Server 2013 Cumulative Update 19Microsoft Exchange Server 2013 Cumulative Update 20Microsoft Exchange Server 2013 Service Pack 1Microsoft Exchange Server 2016 Cumulative Update 8Microsoft Exchange Server 2016 Cumulative Update 9