-
Notifications
You must be signed in to change notification settings - Fork 341
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1849 from microsoft/OctSu
Oct SU Changes
- Loading branch information
Showing
31 changed files
with
1,197 additions
and
108 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
48 changes: 0 additions & 48 deletions
48
Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCve-2023-21709.ps1
This file was deleted.
Oops, something went wrong.
75 changes: 75 additions & 0 deletions
75
Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCve-2023-36434.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| # Copyright (c) Microsoft Corporation. | ||
| # Licensed under the MIT License. | ||
|
|
||
| . $PSScriptRoot\..\Add-AnalyzedResultInformation.ps1 | ||
| function Invoke-AnalyzerSecurityCve-2023-36434 { | ||
| [CmdletBinding()] | ||
| param( | ||
| [Parameter(Mandatory = $true)] | ||
| [ref]$AnalyzeResults, | ||
|
|
||
| [Parameter(Mandatory = $true)] | ||
| [object]$SecurityObject, | ||
|
|
||
| [Parameter(Mandatory = $true)] | ||
| [object]$DisplayGroupingKey | ||
| ) | ||
|
|
||
| <# | ||
| Description: Check for CVE-2023-36434 vulnerability (also tracked as CVE-2023-21709) | ||
| Affected Exchange versions: 2016, 2019 | ||
| Fix: Install October 2023 Windows Security Update | ||
| Workaround: Remove TokenCacheModule from IIS by running the CVE-2023-21709.ps1 script | ||
| #> | ||
|
|
||
| begin { | ||
| Write-Verbose "Calling: $($MyInvocation.MyCommand)" | ||
| $tokenCacheModuleVersionInformation = $SecurityObject.ExchangeInformation.IISSettings.IISTokenCacheModuleInformation | ||
| $tokenCacheFixedVersionNumber = $null | ||
| $tokenCacheVersionGreaterOrEqual = $false | ||
| } | ||
| process { | ||
| if ($SecurityObject.IsEdgeServer -eq $false) { | ||
| Write-Verbose "Testing CVE: CVE-2023-21709 / CVE-2023-36434" | ||
|
|
||
| if ($SecurityObject.ExchangeInformation.IISSettings.IISModulesInformation.ModuleList.Name -contains "TokenCacheModule") { | ||
| Write-Verbose "TokenCacheModule detected - system could be vulnerable to CVE-2023-21709 / CVE-2023-36434 vulnerability" | ||
|
|
||
| if ($null -ne $tokenCacheModuleVersionInformation) { | ||
| Write-Verbose "TokenCacheModule build information found - performing build analysis now..." | ||
| switch ($tokenCacheModuleVersionInformation.FileBuildPart) { | ||
| 9200 { $tokenCacheFixedVersionNumber = "8.0.9200.24514"; break } # Windows Server 2012 | ||
| 9600 { $tokenCacheFixedVersionNumber = "8.5.9600.21613"; break } # Windows Server 2012 R2 | ||
| 14393 { $tokenCacheFixedVersionNumber = "10.0.14393.6343"; break } # Windows Server 2016 | ||
| 17763 { $tokenCacheFixedVersionNumber = "10.0.17763.4968"; break } # Windows Server 2019 | ||
| 20348 { $tokenCacheFixedVersionNumber = "10.0.20348.2029"; break } # Windows Server 2022 | ||
| default { Write-Verbose "No fixed TokenCacheModule version available for Windows OS build: $($tokenCacheModuleVersionInformation.FileBuildPart)" } | ||
| } | ||
|
|
||
| if ($null -ne $tokenCacheFixedVersionNumber) { | ||
| Write-Verbose "Build: $($tokenCacheModuleVersionInformation.FileBuildPart) found - testing against version: $tokenCacheFixedVersionNumber" | ||
| $tokenCacheVersionGreaterOrEqual = ([system.version]$tokenCacheModuleVersionInformation.ProductVersion -ge $tokenCacheFixedVersionNumber) | ||
| Write-Verbose "Version: $($tokenCacheModuleVersionInformation.ProductVersion) is greater or equal the expected version? $tokenCacheVersionGreaterOrEqual" | ||
| } | ||
| } else { | ||
| Write-Verbose "We were unable to query TokenCacheModule build information - as the module is loaded, we're assuming that it's vulnerable" | ||
| } | ||
|
|
||
| if ($tokenCacheVersionGreaterOrEqual -eq $false) { | ||
| $params = @{ | ||
| AnalyzedInformation = $AnalyzeResults | ||
| DisplayGroupingKey = $DisplayGroupingKey | ||
| Name = "Security Vulnerability" | ||
| Details = ("{0}`r`n`t`tSee: https://portal.msrc.microsoft.com/security-guidance/advisory/{0} for more information." -f "CVE-2023-36434") | ||
| DisplayWriteType = "Red" | ||
| DisplayTestingValue = "CVE-2023-36434" | ||
| AddHtmlDetailRow = $false | ||
| } | ||
| Add-AnalyzedResultInformation @params | ||
| } | ||
| } | ||
| } else { | ||
| Write-Verbose "Edge Server Role is not affected by this vulnerability as it has no IIS installed" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
42 changes: 42 additions & 0 deletions
42
...ics/HealthChecker/Tests/DataCollection/E15/Exchange/IIS/GetVersionInformationCachTokn.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"> | ||
| <Obj RefId="0"> | ||
| <TN RefId="0"> | ||
| <T>System.Diagnostics.FileVersionInfo</T> | ||
| <T>System.Object</T> | ||
| </TN> | ||
| <ToString>File: C:\windows\System32\inetsrv\cachtokn.dll_x000D__x000A_InternalName: cachtokn.dll_x000D__x000A_OriginalFilename: cachtokn.dll_x000D__x000A_FileVersion: 8.5.9600.0 (rs1_release.160715-1616)_x000D__x000A_FileDescription: token cache provider_x000D__x000A_Product: Internet Information Services_x000D__x000A_ProductVersion: 8.5.9600.0_x000D__x000A_Debug: False_x000D__x000A_Patched: False_x000D__x000A_PreRelease: False_x000D__x000A_PrivateBuild: False_x000D__x000A_SpecialBuild: False_x000D__x000A_Language: Language Neutral_x000D__x000A_</ToString> | ||
| <Props> | ||
| <S N="Comments"></S> | ||
| <S N="CompanyName">Microsoft Corporation</S> | ||
| <I32 N="FileBuildPart">9600</I32> | ||
| <S N="FileDescription">token cache provider</S> | ||
| <I32 N="FileMajorPart">8</I32> | ||
| <I32 N="FileMinorPart">5</I32> | ||
| <S N="FileName">C:\windows\System32\inetsrv\cachtokn.dll</S> | ||
| <I32 N="FilePrivatePart">0</I32> | ||
| <S N="FileVersion">8.5.9600.0 (rs1_release.160715-1616)</S> | ||
| <S N="InternalName">cachtokn.dll</S> | ||
| <B N="IsDebug">false</B> | ||
| <B N="IsPatched">false</B> | ||
| <B N="IsPrivateBuild">false</B> | ||
| <B N="IsPreRelease">false</B> | ||
| <B N="IsSpecialBuild">false</B> | ||
| <S N="Language">Language Neutral</S> | ||
| <S N="LegalCopyright">© Microsoft Corporation. All rights reserved.</S> | ||
| <S N="LegalTrademarks"></S> | ||
| <S N="OriginalFilename">cachtokn.dll</S> | ||
| <S N="PrivateBuild"></S> | ||
| <I32 N="ProductBuildPart">9600</I32> | ||
| <I32 N="ProductMajorPart">8</I32> | ||
| <I32 N="ProductMinorPart">5</I32> | ||
| <S N="ProductName">Internet Information Services</S> | ||
| <I32 N="ProductPrivatePart">0</I32> | ||
| <S N="ProductVersion">8.5.9600.0</S> | ||
| <S N="SpecialBuild"></S> | ||
| </Props> | ||
| <MS> | ||
| <Version N="FileVersionRaw">8.5.9600.0</Version> | ||
| <Version N="ProductVersionRaw">8.5.9600.0</Version> | ||
| </MS> | ||
| </Obj> | ||
| </Objs> |
Oops, something went wrong.