Tux Machines

Microsoft changes mitigation guidance for zero-days, but tells no one: claim

Posted by Roy Schestowitz on Oct 05, 2022

Microsoft has changed a portion of the advice it issued for mitigation of two bugs in its Exchange Server product, but made no mention of the change, well-known British security researcher Kevin Beaumont says, adding that it looked like the company needed to familiarise itself with the source code of this product.

The bugs, both zero-day vulnerabilities reported to be affecting Microsoft Exchange Server 2013, 2016, and 2019, are similar to the ProxyShell vulnerability for which updates were issued by Microsoft in May and July last year.

ProxyShell comprises three separate bugs used as an integrated attack chain and allowed attackers to bypass authentication and execute code as a privileged user.

Read on