Published by Cybersecurity & Infrastructure Security Agency 10 March 2021
Three new notices have been released by the Cybersecurity & Infrastructure Security Agency (CISA):
- FBI-CISA Joint Advisory on Compromise of Microsoft Exchange Server
Today (3/10), CISA and the Federal Bureau of Investigation (FBI) released a Joint Cybersecurity Advisory to address recently disclosed vulnerabilities in Microsoft Exchange Server. CISA and FBI assess that adversaries could exploit these vulnerabilities to compromise networks and steal information, encrypt data for ransom, or even execute a destructive attack. The Joint Cybersecurity Alert places the malicious cyber actor activity observed in the current Microsoft Exchange Server product compromise into the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework.
CISA recommends organizations to review Joint CSA: AA-21-069 Compromise of Microsoft Exchange Server as well as the CISA Remediating Microsoft Exchange Vulnerabilities web page for guidance on detecting, protecting against, and remediating this malicious activity.
- F5 Releases Security Advisory for Multiple Vulnerabilities in BIG-IP, BIG-IQ
Earlier today (3/10), F5 announced multiple CVEs impacting BIG-IP and BIG-IQ devices. Of these, four are criticalremote code execution vulnerabilities, whereby an attacker could exploit these to take control of an affected system. Two related CVEs are buffer-overflow vulnerabilities. If triggered, a buffer overflow would result in a DoS attack, and—in certain situations — may allow remote code execution. To fully remediate the critical vulnerabilities, BIG-IP customers must update to a patched version as soon as possible.
CISA has published a current activity alert on the specific vulnerabilities affecting BIG-IP and BIG-IQ. For additional detail, organizations are encouraged to review the information provided by F5 — including related security advisories and supplemental information—to help determine the impact on their devices.
- Supply Chain Compromise Short Term Remediation
Last evening (3/9), CISA began releasing new resources to support federal departments and agencies affected by related threat activity associated with the compromise of certain versions of the SolarWinds Orion platform.
These resources provide technical remediation guidance based on the three categories previously outlined in Activity Alert AA20-352A, to include related public and private sector resources recommended by CISA. The guidance will assist organizations with understanding the steps for detecting, mitigating, and evicting this threat actor from their networks, and prevent the actor’s re-use of similar tactics, techniques, and procedures. These steps will prepare federal departments and agencies for long-term actions to build more secure, resilient networks.
Although the information released will be tailored to federal departments and agencies, CISA encourages critical infrastructure, private sector organizations, and other affected entities to refer to Mitigating and Remediating APT-Compromised Networks for eviction guidance and technical resources and cisa.gov/supply-chain-compromise for general information on this compromise and related activity.
