This alert is relevant to Australians who are running Microsoft products. This alert is intended to be understood by slightly more technical users. Users are encouraged to apply any available patches as soon as possible.
Background / What has happened?
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has reviewed the Microsoft August 2023 Security Update.
- The Security Update provided patches for 87 vulnerabilities.
- 2 vulnerabilities are believed to have been exploited.
- 6 vulnerabilities are rated ‘Critical’.
The following vulnerabilities are important based on their severity, widespread use of the related product and/or likelihood of exploitation.
Microsoft Exchange Server RCE (CVE-2023-35388)
- An important rated vulnerability which allows Remote Code Execution.
- Authenticated attackers are able to gain code execution at elevated privileges (NT AUTHORITY/SYSTEM).
- This vulnerability is accessible only if the attacker has LAN access to the exchange server.
- Microsoft has labelled this as "Exploitation More Likely".
Microsoft Exchange Server RCE (CVE-2023-38185)
- An important rated vulnerability which allows Remote Code Execution.
- Authenticated attackers are able to gain code execution across a network call.
Microsoft Exchange Server RCE (CVE-2023-38182)
- An important rated vulnerability which allows Remote Code Execution.
- Authenticated attackers are able to gain code execution if they have LAN access to the exchange server.
- Microsoft has labelled this as "Exploitation More Likely".
Mitigation / How do I stay secure?
Technical subject matter experts that use Microsoft products should read the associated Microsoft security update guides available for their products.
General users should consider enabling automatic patching of Microsoft products if they have not already done so. Advice is available on the Protect Yourself: Updates page.
Assistance / Where can I go for help?
Organisations or individuals that have been impacted or require assistance can contact us via 1300 CYBER1 (1300 292 371).