CVE-2023-23397, please mention which AMCORE/MEDAT for ENS / Security For Exchange 8.8 cover

[SWISS]

15.03.2023

Outlook Leak

CVE-2023-23397, please mention which AMCORE/MEDAT for ENS / Security For Exchange 8.8, ATD SMTP Module cover?

Microsoft has confirmed that a critical Outlook vulnerability, rated at 9.8 out of a maximum 10, is known to have already been exploited in the wild. If you think that sounds bad, it get's worse: the exploit is triggered upon receipt of a malicious email, and so is executed before that email is read in the preview pane. That's right; this is a no-user-interaction required exploit. Here's what we know about the new Microsoft Outlook zero-day.

[Daveb3d]

This might be a better solution:

hxxps://github[.]com/microsoft/CSS-Exchange/blob/a4c096e8b6e6eddeba2f42910f165681ed64adf7/docs/Security/CVE-2023-23397.md

[SWISS]

Hello Dave 😉

My second line i do is Exchange consulting so is was just going through that SOP from MS and giving them some feedback. Because MS customers struggle with that options and misunderstand what it does.

Yes but that is for FORENSIC and IOC and you can also Search and replace the ones you got in BEFORE they reach outlook.exe.

Not prevent (Like the Patch for Outlook.exe does)

And i was asking MS what they think regular Exchange On Premise inhouse Admins can should do.

The Script open the throttle Policy (Like in MDM User) and it need FULL right to everyone's mailbox.

Exchange handles that with roles and group but still from a legal point and compliance that is heavy stuff.

You search all E-Mail or Parameters from the E-Mail from everyone.

Best is the script will replace parts and who knows what happens with International Language Versions of Exchange like German or Asian. There where so many cases in the past this did not work. (From Public Folder scripts to Quick Fixes or Meeting end date date fixes)

[SWISS · Accepted solution]

Let's answer myself 😉

17.03.2023 AMCORE

20.03.2023 NO Info for ATD-Sandbox SMTP Module (Guess that would be an MSME 8.8 Update so they can query the special Reminder Attribute URL field > The current solution they don't handle it)

https://kcm.trellix.com/corporate/index?page=content&id=KB96418

[ZeeArhaan]

Thank you for reaching out to Trellix Community.

I am afraid from the ENS Exploit Prevention Coverage perspective, as of now, our internal resources have tried reproducing the POC for CVE-2023-23397 and confirmed that this is currently out of scope for ENS Exploit Prevention.

Best Regards.

[SWISS]

What now? 

https://kcm.trellix.com/corporate/index?page=content&id=KB96418

Says AMCORE 17.03.2023, you say NO?

[ZeeArhaan]

Thank you for your response! AMCore content release is for coverage to protect any file and hash-based behavior associated with the CVE-2023-23397, although, for the Exploit prevention coverage it is out of scope.

Best Regards

[SWISS]

Any Update SINCE the Outlook.exe patch did ONLY solve this EXTERNAL (WAN) but the problem is still open internal as we understood (SMB from internal Share following IE-TRust Zones).