{"id":724882,"date":"2020-02-05T11:52:38","date_gmt":"2020-02-05T19:52:38","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=724882"},"modified":"2022-02-16T10:46:50","modified_gmt":"2022-02-16T18:46:50","slug":"critical-microsoft-windows-cryptographic-vulnerabilities-and-esri-products","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/arcgis-online\/administration\/critical-microsoft-windows-cryptographic-vulnerabilities-and-esri-products","title":{"rendered":"Critical Microsoft Windows Cryptographic Vulnerabilities and Esri Products"},"author":3911,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[24081],"industry":[],"product":[36571,36551,763582],"class_list":["post-724882","blog","type-blog","status-publish","format-standard","hentry","category-administration","tag-ssamymlgp","product-arcgis-enterprise","product-arcgis-online","product-trust-arcgis"],"acf":{"short_description":"Statement concerning the widely announced CVE-2020-0601 Microsoft OS cryptographic vulnerability and Esri products.","flexible_content":[{"acf_fc_layout":"content","content":"

The National Security Agency (NSA) has taken the unusual step of notifying Microsoft about a significant vulnerability (CVE-2020-0601) which Microsoft released a patch for in January.\u00a0 As part of our FedRAMP authorization for ArcGIS Online, we pay close attention to Binding Operational Directives and Emergency Directives<\/a> issued by the Department of Homeland Security.\u00a0 Due to the publicity of the concern, we have had several customers reach out to us to understand if our offerings are vulnerable, resulting in us posting this summary.<\/p>\n

ArcGIS Online customers were not affected by this vulnerability as the Windows servers are not directly exposed to the Internet for external access as part of our offering.\u00a0 Any Windows Servers utilized for ArcGIS Online back-end operations were patched by January 31, 2020 as a security in-depth precaution.<\/p>\n

Esri does not embed the affected cryptographic functions within our products but are instead provided as part of your operating system deployment.\u00a0 Customers managing their own ArcGIS Enterprise implementations running affected operating systems should ensure that all MS January 2020 patches are applied ASAP.\u00a0 We have not observed any conflicts with our products and the associated security patches and strongly recommend they are applied across any organization\u2019s operations if applicable (both server and client systems).\u00a0 If your organization utilizes images for cloud deployments, please ensure you update those systems immediately too.<\/p>\n

This issue serves as a great reminder of the value of terminating your web service encryption endpoints on a security gateway device in front of your web application services to reduce headaches across your operations.\u00a0 The NSA has provided a great summary concerning the issue and mitigation actions here<\/a>.<\/p>\n

 <\/p>\n