<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span class="x_elementToProof x_ContentPasted0" data-ogsc="rgb(0, 0, 0)" data-ogsb="rgb(255, 255, 255)" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); display: inline !important;"><b>The
Information Security Office is planning to filter and/or block ICMP traffic inbound to the campus from the Internet and is requesting your partnership in identifying any potential adverse impact.</b><br>
<br>
There is a vulnerability in Windows 10/11 and Windows Server 2008/2012/2016/2019/2022 related to ICMP. </span><span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; font-size: 15px; background-color: rgb(255, 255, 255); display: inline !important;"></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<div class="x_elementToProof" style="font-size: 15px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="margin:0px"><br>
</span></div>
<div class="x_elementToProof" style="font-size: 15px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-size:12pt;font-family:Calibri, Helvetica, sans-serif;margin:0px">Essentially, a malicious actor can send a crafted ICMP packet to a vulnerable Windows host to execute arbitrary code on the remote system. See attached Mandiant Advantage vulnerability
report (PDF).</span></div>
<div class="x_elementToProof" style="font-size: 15px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-size:12pt;font-family:Calibri, Helvetica, sans-serif;margin:0px"><br>
</span></div>
<div class="x_elementToProof" style="font-size: 15px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-size:12pt;font-family:Calibri, Helvetica, sans-serif;margin:0px"><span class="x_ContentPasted1" data-ogsc="rgb(0, 0, 0)" data-ogsb="rgb(255, 255, 255)" style="margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); display: inline !important;">This
vulnerability is identified as CVE-2023-23415 with a CVSS Score of 9.8 (out of 10).</span><br>
</span></div>
<div class="x_elementToProof" style="font-size: 15px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="margin:0px"><br>
</span></div>
<div class="x_elementToProof" style="font-size: 15px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-size:12pt;font-family:Calibri, Helvetica, sans-serif;margin:0px">While exploit code is not yet in the wild and Windows patches are now available, the Information Security Office believes this is a high-risk, high-impact threat that the campus
must be prepared to mitigate against.</span></div>
<div class="x_elementToProof" style="font-size: 15px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, "system-ui", Roboto, "Helvetica Neue", sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="margin:0px"><br>
</span></div>
<div class="x_elementToProof" data-ogsc="rgb(0, 0, 0)" data-ogsb="rgb(255, 255, 255)" style="font-size: 12pt; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family:Calibri, Helvetica, sans-serif;margin:0px">In order to mitigate this threat, the Information Security Office is investigating the feasibility of filtering and/or blocking ICMP traffic inbound to campus from the Internet.</span></div>
<div class="x_elementToProof" data-ogsc="rgb(0, 0, 0)" data-ogsb="rgb(255, 255, 255)" style="font-size: 12pt; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family:Calibri, Helvetica, sans-serif;margin:0px"><br>
</span></div>
<div class="x_elementToProof" data-ogsc="rgb(0, 0, 0)" data-ogsb="rgb(255, 255, 255)" style="font-size: 12pt; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
If anyone in CITL knows of any adverse impact this action would have on campus networked services, please send me your feedback directly - jonathan.ocab@ucr.edu.<br>
<br>
Thank you.</div>
</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif;">
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0"></p>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">---</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Jonathan Ocab |
</span><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt"><a href="mailto:jonathan.ocab@ucr.edu" target="_blank" rel="noopener noreferrer" data-loopstyle="link">jonathan.ocab@ucr.edu</a></span></div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Manager, Information Security Operations</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Information Security Office</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">University of California, Riverside</span></div>
<p style="margin-top:0px; margin-bottom:0px"></p>
</div>
</div>
</div>
</div>
</body>
</html>