regsamp
asked on
CVE-2021-34473 Vulnerability found on Exchange 2016 Server
We had a firm run an independent scan on our Windows 2016/Exchange 2016 Server and the one weakness they found running a PIN test is listed below:
We are looking for any recommendations/advice to patch this vulnerability. Thank you.
| Critical | ||||
| 10 | CVE | CVE-2021-34473 | ||
| IP(s) | ||||
| Description | ||||
| The Microsoft Exchange running on the remote host is affected by a remote code execution vulnerability. An unauthenticated remote attacker can exploit this to execute arbitrary code. | ||||
| Solution | ||||
| Microsoft has released the following security updates to address this issue: -KB5001799 | ||||
Last Comment
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
this is the same July update for CU20
there is no July patch for CU19 since only the latest 2 CU updates are supported; you won't see any more updates for CU19
there is no July patch for CU19 since only the latest 2 CU updates are supported; you won't see any more updates for CU19
Security Update For Exchange Server 2016 CU20
https://www.microsoft.com/en-us/download/details.aspx?id=103310ASKER
So my question is if we are still on CU 19, do we have to do this update first:
https://www.microsoft.com/en-us/download/details.aspx?id=103001 or can we go to the updates you posted?
https://www.microsoft.com/en-us/download/details.aspx?id=103001 or can we go to the updates you posted?
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Scott, you are saying reboot the Exchange server and then install the following below in order, correct?
Cumulative Update 21 for Exchange Server 2016
https://www.microsoft.com/en-us/download/details.aspx?id=103242Security Update For Exchange Server 2016 CU21
https://www.microsoft.com/en-us/download/details.aspx?id=103311SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
"Correct. CU's are cummulative, so contain all prior CU's (but not necessarily all the fixes published independently).
So: Boot, CU, (Boot,) Security Fix for CU." Perfect. Thank you.
So: Boot, CU, (Boot,) Security Fix for CU." Perfect. Thank you.
Exchange
Exchange is the server side of a collaborative application product that is part of the Microsoft Server infrastructure. Exchange's major features include email, calendaring, contacts and tasks, support for mobile and web-based access to information, and support for data storage.
213K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
ASKER
suggest going to CU21 (final CU) and the following security update released in July
Exchange has been a big hacker target in recent months so make sure you keep up with updates"
Do you know if we can bypass the CU 19 updates and the updates from May and right to the July CU updates?