Let’s mention the important things first: Please patch you vulnerable Exchange 2013, 2016 and 2019 immediately! The page msxfaq has published an infosite to this vulnerability including the instructions how to fix your Exchange.
Even though we, as Boll Engineering AG, are not associated in any way with the affected product, a lot of our customer reported, that they have vulnerable systems in place and may be affected by this bug. We have been asked if IPS signatures and WAF patches are already implemented. Therefore we decided to post this blog to raise the awareness of this vulnerability once more, even after the broad press has already published a lot of releases regarding this matter.
This blog post regards the following CVE reports:
CVE-2021-26855
CVE-2021-26857
CVE-2021-26858 and CVE-2021-27065
Below you can find the related articles or microsites to the matter from our different vendors we distribute.
Please note, that some of the solutions had a signature in place already, when the broad exploitation of the vulnerability started. Therefore not only the information IF a signature is available, it is also important from WHEN this signature has been applied on your system.
Fortinet
Protection is available
https://fndn.fortinet.net/FortiGuard-Alert-Outbreaks/Hafnium-full/
FortiSIEM is even able to detect activities related to this vulnerability.
Palo Alto
Protection is available
https://unit42.paloaltonetworks.com/microsoft-exchange-server-attack-timeline/
Kaspersky
Protection is available
https://www.kaspersky.com/blog/exchange-vulnerabilities/38964/
WatchGuard
Protection is available
https://techsearch.watchguard.com/KB?SFDCID=kA10H000000Xe1SSAS
https://www.secplicity.org/2021/03/08/chinese-state-actors-exploit-0-day-vulnerabilities-targeting-on-premise-exchange-server
