erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: July 13, 2021

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: ProxyOracle. Anyone with an on-premises Exchange 2013, 2016 or 2019 server still on a build older than the July 2021 Security Update, especially with Outlook Web Access reachable from the internet.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2021-31196

Exchange CVE-2021-31196: ProxyOracle Padding Oracle in KEV

Fixed in July 2021 and flagged as exploited only in 2024; the real question is whether any Exchange server that old still runs, because one that does has far bigger problems than this bug.

Must act: Anyone with an on-premises Exchange 2013, 2016 or 2019 server still on a build older than the July 2021 Security Update, especially with Outlook Web Access reachable from the internet.

Can relax: Exchange Online-only tenants and on-premises shops running Exchange Server Subscription Edition with current Security Updates are not exposed to this bug.

  1. Record the exact build of every on-premises Exchange server with the Health Checker script or Exsetup.exe, not just the CU.
  2. Take any server older than the July 2021 Security Update off the internet now and treat it as possibly compromised.
  3. Migrate remaining Exchange 2013, 2016 and 2019 servers to Exchange Server SE or Exchange Online; none of them receive updates any more.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.