The Microsoft Exchange Server installed on the remote host is missing security updates. A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. An attacker could then install programs; view, change, or delete data; or create new accounts.

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists in     Microsoft Exchange Server. An attacker who successfully     exploited this vulnerability could gain the same rights     as any other user of the Exchange server. This could     allow the attacker to perform activities such as     accessing the mailboxes of other users. Exploitation of     this vulnerability requires Exchange Web Services (EWS)     to be enabled and in use in an affected environment.
    (CVE-2020-0692)

  - A remote code execution vulnerability exists in     Microsoft Exchange software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the System user. An     attacker could then install programs; view, change, or     delete data; or create new accounts. Exploitation of the     vulnerability requires that a specially crafted email be     sent to a vulnerable Exchange server. The security     update addresses the vulnerability by correcting how     Microsoft Exchange handles objects in memory.
    (CVE-2020-0688)

ID	Name	Product	Family	Published	Updated	Severity
701277	Microsoft Exchange Remote Code Execution Vulnerability	Nessus Network Monitor	SMTP Servers	2020/03/06	2020/03/06	high
133617	Security Updates for Exchange (February 2020)	Nessus	Windows : Microsoft Bulletins	2020/02/11	2020/09/04	high

Plugins Search