Exchange Pwn2Own Vulnerability April 2021 (Yes, a new one – it’s not Hafnium anymore!)

Let’s mention the important things first: Please patch you vulnerable Exchange 2013, 2016 and 2019 immediately! The page msxfaq has published an infosite to this vulnerability including the instructions how to fix your Exchange.

Some security researchers have demonstrated three high risk vulnerabilities for exchange server systems. Microsoft has published information about the vulnerability today and even has a patch for the problem already in place.

Even though we, as Boll Engineering AG, are not associated in any way with the affected product, a lot of our customer reported, that they have vulnerable systems in place and may be affected by this bug. We have been asked if IPS signatures and WAF patches are already implemented. Therefore we decided to post this blog to raise the awareness of this vulnerability once more, even after the broad press has already published a lot of releases regarding this matter.

This blog post regards the following CVE reports:

CVE-2021-28480
CVE-2021-28481
CVE-2021-28482
CVE-2021-28483

Protection in place?

We will inform you here, as soon as our vendors have protection for those vulnerabilities in place.

Last update: 15.04.2021 13:40

Fortinet

Protection is available (for FortiClient only at the moment)

https://www.fortiguard.com/encyclopedia/endpoint-vuln/67270

Exchange Hafnium Vulnerability March 2021

Let’s mention the important things first: Please patch you vulnerable Exchange 2013, 2016 and 2019 immediately! The page msxfaq has published an infosite to this vulnerability including the instructions how to fix your Exchange.

Even though we, as Boll Engineering AG, are not associated in any way with the affected product, a lot of our customer reported, that they have vulnerable systems in place and may be affected by this bug. We have been asked if IPS signatures and WAF patches are already implemented. Therefore we decided to post this blog to raise the awareness of this vulnerability once more, even after the broad press has already published a lot of releases regarding this matter.

This blog post regards the following CVE reports:

CVE-2021-26855
CVE-2021-26857
CVE-2021-26858 and CVE-2021-27065

Below you can find the related articles or microsites to the matter from our different vendors we distribute.

Please note, that some of the solutions had a signature in place already, when the broad exploitation of the vulnerability started. Therefore not only the information IF a signature is available, it is also important from WHEN this signature has been applied on your system.

Fortinet

Protection is available

https://fndn.fortinet.net/FortiGuard-Alert-Outbreaks/Hafnium-full/

FortiSIEM is even able to detect activities related to this vulnerability.

Palo Alto

Protection is available

https://unit42.paloaltonetworks.com/microsoft-exchange-server-attack-timeline/

Kaspersky

Protection is available

https://www.kaspersky.com/blog/exchange-vulnerabilities/38964/

WatchGuard

Protection is available

https://techsearch.watchguard.com/KB?SFDCID=kA10H000000Xe1SSAS
https://www.secplicity.org/2021/03/08/chinese-state-actors-exploit-0-day-vulnerabilities-targeting-on-premise-exchange-server

WatchGuard new Knowledge Base Articles November 2020

Each month WatchGuard publishes numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in November:

Articles

Firebox Cloud supports accelerated networking in Azure

Known Issues

IKEv2 profile import fails on macOS Big Sur 11.0.1
DHCPv6 server restarts repeatedly when DHCP reservation exists
Hotspot custom logo does not load in Fireware v12.6.2
Cannot edit SD-WAN actions after you change the names of multiple external VLAN interfaces
Application Control category actions not applied correctly on 12.5.x Firebox fully managed by Management Server 12.6.x
Upgrading from Dimension 2.1.2 to Dimension 2.1.2 Update 4 fails due to lack of free disk space
Application Control category action changes to Drop after upgrade to Fireware v12.6.2
Interfaces with fixed link speeds change to 10 Mbps Half Duplex after upgrade from Fireware v12.5.4 to v12.6.2
Files load slowly through an HTTPS-proxy when content inspection is enabled with Application Control or IPS
AP125 and AP325 reboot after kernel panic message
Mobile VPN with SSL client not supported on Windows devices with ARM processors

WatchGuard announces Dark Web Scan Feature

WatchGuard announced in the last days a new feature called Dark Web Scan. The feature is hosted in the WatchGuard cloud. With this new tool, you can perform searches based on email addresses and domain names to see which accounts have been exposed on the dark web during known data breaches.

Here are some screenshots from my test:

You can find the Dark Web Scan in your WatchGuard Cloud account under Administration –> Dark Web Scan
«WatchGuard announces Dark Web Scan Feature» weiterlesen

WatchGuard Fireware Features pro Version

Sicherlich haben Sie sich schon gefragt, wann welches Feature in welchem Fireware Release eingeführt wurde. Da sich dies nur mühsam per Release Notes oder Dokumentation rausfinden lässt, hat WatchGuard für ihre Features einen KB Artikel mit einer Feature Liste pro Version erstellt:

New Firebox features by Fireware version
https://watchguardsupport.secure.force.com/publicKB?type=Article&SFDCID=kA10H000000boxYSAQ&lang=en_US

WatchGuard Authentication fails with AuthPoint Gateway lower than version 5.1.5

What is the problem?
AuthPoint Gateway software must be updated to the latest available version, v5.1.5 before the week of 10 October 2019. If you do not update your AuthPoint Gateway before 10 October, it is likely that all authentication will fail for your AuthPoint user base.

When must I update my AuthPoint Gateway?
If you use AuthPoint Gateway software v5.1.3.158 or lower, you must update your Gateway software to v5.1.5 as soon as possible. If you update your Gateway software before the dates referenced below, this issue will not impact you.

  • For AuthPoint users in the APAC cloud region – 10 October 2019
  • For AuthPoint users in the EMEA cloud region – 16 October 2019
  • For AuthPoint users in the AMER cloud region – 17 October 2019
«WatchGuard Authentication fails with AuthPoint Gateway lower than version 5.1.5» weiterlesen

WatchGuard Fireware 12.5

Watchguard is going to release Fireware version 12.5 in the next few days / weeks. From the public beta phase some new features are already known, which I would like to introduce here:

Update: Fireware 12.5 has been released.
Please check the » What’s New in Fireware v12.5 » presentation for detailed information.

Reverse Proxy for the Access Portal

In the Access Portal configuration, you can now configure reverse proxy actions so remote users can connect to internal web applications and Microsoft Exchange services with an external URL. With reverse proxy actions, you can give remote teams access to internal resources without the need for a VPN. Multi-factor authentication is supported as well.

«WatchGuard Fireware 12.5» weiterlesen

WatchGuard Fireware Version 12.4

WatchGuard hat die neuste Version von Fireware 12.4. herausgebracht. Wir haben hier die grössten Änderungen dokumentiert.

Die Software können Sie auf folgender Seite herunterladen: https://watchguardsupport.secure.force.com/software/
Ebenfalls gibt es ein komplettes What’s new in 12.4 Dokument hier: What’s new in 12.4 oder ein Webinar.

SD-WAN

Fireware bietet bereits seit der Version 12.3. die Funktionalität SD-WAN an, welche die bisherige Funktion policy-based routing ersetzt. Mit SD-WAN ist es möglich, Interface Failover und Failback detailliert zu konfigurieren. Dabei ist es möglich, neu mit 12.4 auch interne Interfaces und BOVPN virtual Interface Tunnels in diese SD-WAN Aktionen miteinzubeziehen. So lassen sich jetzt zum Beispiel eine Aussenstelle mittels einem BOVPN und einer Mitleitung, welche intern geroutet wird, überwachen und bei Ausfall entsprechend zu reagieren. Auf den jeweiligen Interfaces lassen sich die Paketverlustrate, Latency und Jitter messen und anhand diesen Kriterien ein Failover veranlassen.

«WatchGuard Fireware Version 12.4» weiterlesen

Update: Boll USB RJ45 Serial Konsolen Kabel. Auch als USB-C Variante verfügbar!

Unser Boll Serial Konsolen Kabel gibt es ab sofort auch als USB-C Variante. Administratoren mit modernen USB-C Notebooks benötigen somit keinen Adapter mehr. Einfach direkt einstecken. Den Artikel finden sie in unserem Partner Shop in der Kategorie Boll Accessoires. Oder einfach in der  Suchmaske mit dem Artikelnamen ‹UCON90C› eingeben. Für weitere Infos siehe Original Betrag weiter unten

«Update: Boll USB RJ45 Serial Konsolen Kabel. Auch als USB-C Variante verfügbar!» weiterlesen