Security News > 2020 > February > Attackers probing for vulnerable Microsoft Exchange Servers, is yours one of them?

CVE-2020-0688, a remote code execution bug in Microsoft Exchange Server that has been squashed by Microsoft in early February, is ripe for exploitation and could become a vector for ransomware groups in coming months, warns cybersecurity researcher Kevin Beaumont.

Organizations running on-premise Exchange - any supported version up until the recent patch - would do well to patch as soon as possible, as scanning for vulnerable internet-facing servers has already begun.

CVE-2020-0688, initially classified by Microsoft as a memory corruption vulnerability turned out to be caused by Exchange Server failing to properly create unique cryptographic keys at the time of installation.

Microsoft Exchange remote code execution using IIS, simple ascii web request to code execution as SYSTEM on all versions of Exchange using internet interface🚨 Needs authentication, I'll explain why not a big hurdle in thread. https://t.

Having SYSTEM access to an Exchange Server and running Mimikatz could also give attackers access to plain-text user passwords, Beaumont noted.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/eEoAb92vnIk/