duijv023 0 Posted March 16 Share Posted March 16 As the title says… can ECOS detect and block e-mails that exploit CVE-2023-23397? Quote Link to comment Share on other sites More sharing options...
itman 1,508 Posted March 16 Share Posted March 16 Patch your devices ASAP! Microsoft included a mitigation for this in the March, 2023 security updates. Otherwise, follow additional mitigations Microsoft has listed here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397?ref=cisco-talos-blog . Quote Link to comment Share on other sites More sharing options...
DM R 0 Posted March 16 Share Posted March 16 @itman any eset pov mitigation? Quote Link to comment Share on other sites More sharing options...
itman 1,508 Posted March 16 Share Posted March 16 (edited) 12 minutes ago, DM R said: @itman any eset pov mitigation? Only Eset can answer this. I wouldn't "hold my breath" on an Eset solution since the security researcher who analyzed the attack can't figure out how it works: Quote After reviewing a script from Microsoft that checks Exchange messaging items for signs of exploitation using CVE-2023-23397, MDSec’s red team member Dominic Chell discovered how easily a threat actor could leverage the bug. He found that the script could look for the “PidLidReminderFileParameter” property inside the received mail items and remove it when present. Chell explains that this property lets the sender define the filename that the Outlook client should play when the message reminder is triggered. The reason why this was possible remains a puzzle that the researcher could not spell out since the sender of an email should not be able to configure the sound for the new message alert on the receiver's system. https://www.bleepingcomputer.com/news/security/critical-microsoft-outlook-bug-poc-shows-how-easy-it-is-to-exploit/ Edited March 16 by itman Quote Link to comment Share on other sites More sharing options...
duijv023 0 Posted March 16 Author Share Posted March 16 Of course… I’m not saying you shouldn’t patch nor mitigate in other means. I’m just very curious about ECOS playing their role in the game of multi layer defense! Quote Link to comment Share on other sites More sharing options...
Administrators Marcos 4,602 Posted March 17 Administrators Share Posted March 17 We're investigating it, it's too early to tell if ECOS and mail server will be able to detect it. Quote Link to comment Share on other sites More sharing options...
Solution duijv023 0 Posted March 17 Author Solution Share Posted March 17 9 hours ago, Marcos said: We're investigating it, it's too early to tell if ECOS and mail server will be able to detect it. Thank you Marcos, greetings from Holland! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.