A Closer Look at the New ActiveSync Redirection Feature in Exchange 2013 CU8
On March 17th, Microsoft released Cumulative Update 8 for Exchange Server 2013. By now, we're all...
Edward van Biljon
Introduction to the March 2024 Security Update
The March 2024 security update for Exchange 2019 was released to address several critical vulnerabilities that pose significant risks to system integrity and security. As Exchange 2019 remains a crucial component in many organizations' IT infrastructure, the timely application of security patches is essential. This update aims to mitigate potential threats that could be exploited by malicious adversaries, thereby safeguarding sensitive data, and ensuring the smooth operation of email services.
One of the main vulnerabilities rectified in this security update pertains to an elevation of privilege flaw, which, if left unpatched, could allow attackers to gain unauthorized access to system functionalities. Another critical issue addressed involves a remote code execution vulnerability that could enable an adversary to execute arbitrary code on the affected Exchange server. Both these vulnerabilities underscore the importance of maintaining up-to-date security measures to protect against evolving cyber threats.
In addition to these critical fixes, the March 2024 security update introduces various enhancements aimed at bolstering Exchange 2019's resilience against potential exploits. These improvements are designed to provide comprehensive protection, ensuring that organizations can maintain operational continuity without compromising on security. By applying the update, system administrators can reinforce their defenses against emerging threats and ensure the ongoing protection of their Exchange 2019 environments.
Overall, the March 2024 security update serves as a crucial reminder of the necessity for regular maintenance and updating of IT systems. The application of this update not only addresses immediate security concerns but also fortifies the system against future vulnerabilities. As such, it is imperative for organizations to prioritize the deployment of this and future Exchange security updates to maintain the integrity and security of their Exchange 2019 installations.
The March 2024 security update for Exchange 2019 was met with a mixed reception from users and administrators. While many praised the update for addressing critical vulnerabilities, others reported various issues post-installation. Microsoft advised that the security update stopped two probes from functioning correctly, and end users started reporting that search was not working.
ENow’s Exchange Monitoring and Reporting solution works closely with Microsoft Exchange and some of our customers started noticing that the probes were reporting errors since applying the March 2024 security update in their respective environments.
April 2024 Hotfix
The hotfix for Exchange 2016 and Exchange 2019 was released a month after the March 2024 Security update. This hotfix resolved the probe errors and search errors that were reported by end users. Some end users still advised that search was not working, but when IT fully upgraded all Exchange servers, search functionality returned.
The hotfix also resolved issues for ENow’s Exchange Monitoring customers as probes started reporting data again and the errors previously encountered were no longer seen.
The Shifting Culture of Security at Microsoft
While Microsoft has always valued secure software, infrastructure, and cloud services, they’ve further prioritized it given the rapidly growing state of cyberattacks around the world and that they’ve experienced first-hand. In November 2023, Microsoft committed to advancing the built-in security of their products and platforms, which they’re calling the Secure Future Initiative (SFI).
Following receipt of the Department of Homeland Security’s Cyber Safety Review Board (CSRB) findings following the Storm-0558 cyberattack and the Midnight Blizzard attack, Microsoft has expanded the SFI. In May 2024, Charlie Bell, Executive Vice President, Microsoft Security announced three new guiding security principles, which include: ‘secure by design,’ ‘secure by default,’ and ‘secure operations,’ and six security pillars that provide further detail in the areas where Microsoft is focusing. The pillars are comprised of:
- Protect identities and secrets
- Protect tenants and isolate production systems
- Protect networks
- Protect engineering systems
- Monitor and detect threats
- Accelerate response and remediation
Back to the March 2024 Security Update for Microsoft Exchange and the resulting April hotfix. Following the SFI implementation, Microsoft announced its adoption of the Common Weakness Enumeration (CWE) when describing the root cause of a vulnerability, rather than using its own taxonomy.
You can see this illustrated in the March 2024 Security Update for Microsoft Exchange here:
Figure 1: CWE Taxonomy used in Microsoft's Security Update.
This step towards standardization and transparency will help the Microsoft community collectively find and mitigate weaknesses for future security updates.
Exchange Security Patch: ENow can help you track your progress
Do you have numerous Exchange servers that need to be patched? Understanding the version and patch you are currently running enables you to access the security risk in your environment and ensure the patch was successfully installed. The Exchange version report simply returns the information needed to understand what version your servers are running and if the security patch succeeded.
(PS - don’t forget to reboot your server after applying the patch!)
