CVE-2018-8581 and how Microsoft's workaround affects Exclaimer on-premises products

Relevant Products: Signature Manager Exchange Edition | Signature Manager Outlook Edition

Scenario

You have an Exclaimer on-premises product that utilizes Exchange Web Services (EWS) that is installed on the same Exchange server that it connects to using EWS.

You notice that these connections are failing and an EWS error stating 401 unauthorized is logged - despite the service account being used and having the appropriate permissions in the Exchange environment.

Reason

This error is caused by Microsoft's workaround for CVE-2018-8581 which is automatically applied as part of security or Exchange Cumulative Updates (CU); for more information, see CVE 2018 8581.

Resolution

You can resolve this issue in either one of the following ways:

• Use the following manually specified Exchange URL: https://localhost/ews/exchange.asmx
  
  Note: For some versions of Exchange, you will need to use port 444 instead of port 443.
  
  To confirm the port being used - examine the bindings in the Internet Information Services (IIS).

OR

• Configure a BackConnectionHostname.
  Follow the steps outlined in Method 1 (recommended): Create the Local Security Authority host names that can be referenced in an NTLM authentication request.
  
  Note: The DisableStrictNameChecking registry setting mentioned in the above Microsoft article is not required.