15Apr2021: Added note about Pwn2Own vulnerabilities not being addressed by these updates.
A quick blog on April’s security updates for Exchange Server 2013 up to 2019. Details regarding these vulnerabilities are confidential, but organizations are recommended to install these updates based on their rating. With patching procedures still fresh in everyone’s memory, and every Exchange on-premises server being current after the Hafnium issues, that should not be a problem, right?
The fixes address the following Remote Code Execution vulnerabilities:
| Vulnerability | Severity | Rating |
|---|---|---|
| CVE-2021-28483 | Critical | CVSS:3.0 9.0 / 7.8 |
| CVE-2021-28482 | High | CVSS:3.0 8.8 / 7.7 |
| CVE-2021-28481 | Critical | CVSS:3.0 9.8 / 8.5 |
| CVE-2021-28480 | Critical | CVSS:3.0 9.8 / 8.5 |
More detailed information can be found at the original blog post here. Note that the recently discovered at the Pwn2Own 2021 contest are not (yet) addressed by these updates, according to this blog by the contest organizers.
The exploit can be fixed by single security update, which you can find below.
| Exchange | Download | Build | KB | Supersedes |
| Exchange 2019 CU9 | Download | 15.2.858.10 | KB5001779 | |
| Exchange 2019 CU8 | Download | 15.2.792.13 | KB5001779 | |
| Exchange 2016 CU20 | Download | 15.1.2242.8 | KB5001779 | |
| Exchange 2016 CU19 | Download | 15.1.2176.12 | KB5001779 | |
| Exchange 2013 CU23 | Download | 15.0.1497.15 | KB5001779 |
Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU20 to Exchange 2016 CU19. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU9-KB5001779-x64-en.msp.
Also, run the Security Update from an elevated command prompt, to prevent issues during installation (other words: Do not just double-click on the .MSP file). And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates, and follow a more agile approach. The rating implies a form of urgency.
EighTwOne (821) 
There’s any workaground or mitigation for those cve ? i’m using F5 for load balancer and trendmicro for endpoint (IPS included). Please advice.
LikeLike
Workaround as in? Get current and patch.
LikeLike
I’m on Exchange 2019 CU8 and I applied this patch successfully.
If I want to install Exchange 2019 CU9, do I need to uninstall this patch first? Do I need to reinstall this patch after installing CU9?
Thanks for your help and coverage.
LikeLike