Exchange 2013 SP1 & CU8 Security Update MS15-064 Released
Microsoft has released the security update MS15-064 for Exchange 2013 SP1 and CU8 on this Tuesday.
If you are on Exchange 2013 SP1 or CU 8 then you need to deploy this update. If you are on the following Cumulative Update level then you can ignore this update.
Cumulative Update 1
Cumulative Update 2
Cumulative Update 3
Cumulative Update 5
Cumulative Update 6
Cumulative Update 7
Exchange 2013 CU9 will have this update included.
More information about MS15-064 security update can be found here:
https://technet.microsoft.com/library/security/MS15-064
The most severe of the vulnerabilities could allow elevation of privilege if an authenticated user clicks a link to a specially crafted webpage. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message.
Download the security update from the following linke
Exchange 2013 SP1: https://www.microsoft.com/en-us/download/details.aspx?id=47586
Exchange 2013 CU8: https://www.microsoft.com/en-us/download/details.aspx?id=47587
It might also show up in the list of security updates on windows.
Restart of the server is not required but services will restart so consider applying in the change window
Issues that are fixed in this security update
This security update fixes the following issues that occur in an environment that is running Exchange Server 2013 Service Pack 1 (SP1) or a later update installed:
-
An information disclosure vulnerability exists in Exchange web applications when Exchange does not correctly manage same-origin policy. This security update addresses the vulnerability by changing how Exchange web applications manage same-origin policy in Exchange Server 2013 SP1 and Cumulative Update 8.
-
An elevation of privilege vulnerability exists in Exchange web applications when Exchange does not correctly manage user sessions. This security update addresses the vulnerability by changing how Exchange web applications manage user session authentication in Exchange Server 2013 SP1 and Cumulative Update 8.
-
An information-disclosure vulnerability exists in Exchange web applications when Exchange does not correctly sanitize HTML strings. This security update addresses the vulnerability by correcting how Exchange web applications sanitize HTML strings in Exchange Server 2013 Cumulative Update 8.
For more information check this KB – https://support.microsoft.com/en-us/kb/3062157
Prabhat Nigam
Microsoft MVP | Exchange Server
Team@MSExchangeGuru
Tweet me @PrabhatNigamXHG
