Exchange, On Premises

Its Layers

It is your mail server, so the patching is yours. A flaw in Exchange or IIS can reach the whole mail store.

The stack runs from the top layer down, as on the topic page. Each layer shows its technology, and the badge beside it says who runs and patches it.

Who Runs What

You run every layer, from Exchange down to Windows Server and the hardware. Microsoft ships the fixes, as it did for ProxyLogon while attacks were under way in March 2021, but each one waits on your team to install it.

You

Your team runs it and installs its updates.

Where Its Code Comes From

Almost all of its code arrives in Microsoft's own updates. You depend on their integrity, and on installing them quickly.

• Vendor Updates

Well-Known Flaws in Its Layers

These are well-known flaws in the technologies this stack is built from. Each CVE id links to its advisory, and the technology's own page says how far that flaw reached.

• CVE-2021-26855 (opens in a new tab)2021

  ProxyLogon, in Exchange Server

  A server-side request forgery flaw let an attacker authenticate as the Exchange server.

• CVE-2021-34473 (opens in a new tab)2021

  ProxyShell, in Exchange Server

  Chained with two other flaws, it let attackers run code on unpatched Exchange.

• CVE-2020-1472 (opens in a new tab)2020

  Zerologon, in Windows Server

  A Netlogon flaw let an attacker with no credentials reset a domain controller's password.

• CVE-2017-0144 (opens in a new tab)2017

  EternalBlue, in Windows Server

  A flaw in SMBv1 allowed remote code execution on unpatched Windows machines.

Sources

• Microsoft Learn: shared responsibility in the cloud (opens in a new tab)
• Microsoft: security updates for Exchange Server, March 2021 (opens in a new tab)