【安全更新】微软1月安全更新多个产品高危漏洞通告

2021-01-18 10:22:29 浏览数 (1)

通告编号:NS-2021-0001

2021-01-13

TAG：

安全更新、Windows、Office、SQL Server、Visual Studio、Defender

漏洞危害：

攻击者利用本次安全更新中的漏洞，可造成信息泄露、权限提升、远程代码执行等。

版本：

1.0

1

漏洞概述

北京时间1月13日，微软发布1月安全更新补丁，修复了83个安全问题，涉及Microsoft Windows、Microsoft Office、Microsoft SQL Server、Visual Studio、Microsoft Defender等广泛使用的产品，其中包括远程代码执行和权限提升等高危漏洞类型。

本月微软月度更新修复的漏洞中，严重程度为关键（Critical）的漏洞有9个，重要（Important）漏洞有73个，1个 中危（Moderate）级别漏洞。请相关用户及时更新补丁进行防护，详细漏洞列表请参考附录。

绿盟远程安全评估系统（RSAS）已具备微软此次补丁更新中大多数漏洞的检测能力（包括CVE-2021-1705，CVE-2021-1673，CVE-2021-1668，CVE-2021-1667，CVE-2021-1666，CVE-2021-1665，CVE-2021-1660，CVE-2021-1658等高危漏洞），请相关用户关注绿盟远程安全评估系统系统插件升级包的更新，及时升级至V6.0R02F01.2101，官网链接：http://update.nsfocus.com/update/listRsasDetail/v/vulsys

参考链接：

https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jan

SEE MORE →

2重点漏洞简述

根据产品流行度和漏洞重要性筛选出此次更新中包含影响较大的漏洞，请相关用户重点进行关注：

Microsoft Defender远程代码执行漏洞（CVE-2021-1647）：

Microsoft Defender在扫描文件的过程中存在内存损坏漏洞，攻击者可以通过构造恶意PE文件，通过钓鱼邮件/链接等方式使受害者获取到该恶意文件，并使Microsoft Defender扫描该恶意文件，产生缓冲区溢出，最终造成远程代码执行。微软官方目前已发现该漏洞存在在野利用。

官方通告链接：

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1647

Microsoft splwow64权限提升漏洞（CVE-2021-1648）：

Windows打印驱动程序进程SPLWOW64.exe中存在权限提升漏洞，由于缺少对用户提供的数据进行适当验证，导致可能出现越界读取，攻击者可利用此漏洞进行权限提升，目前已有PoC公开。

官方通告链接：

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1648

SharePoint 远程代码执行漏洞（CVE-2021-1707）：

Microsoft SharePoint存在一个远程代码执行漏洞，经过身份验证的攻击者通过发送特制请求包，可在 SharePoint应用程序池和SharePoint服务器账户上执行任意代码。

官方通告链接：

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1707

Windows Win32k权限提升漏洞 （CVE-2021-1709）：

Win32k系统进程中存在一个权限提升漏洞，经过身份验证的本地攻击者可利用此漏洞在目标系统上提升其权限以执行任意代码。

官方通告链接：

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1709

GDI 远程代码执行漏洞（CVE-2021-1665）：

Windows 图形设备接口 (GDI) 在处理内存中的对象时存在远程代码执行漏洞。攻击者可通过多种方式利用此漏洞，在基于Web的攻击情形中，攻击者可诱导用户打开电子邮件附件或单击电子邮件或即时消息中的链接来访问利用此漏洞的恶意网站；在文件共享攻击情形中，攻击者可诱导用户打开利用此漏洞的特制文件。成功利用此漏洞的攻击者可在目标系统上以当前用户权限执行任意代码。

官方通告链接：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1665

Windows远程桌面协议核心安全功能绕过漏洞（CVE-2021-1674）：

Kerberos 验证流程中存在一处安全特性绕过漏洞。影响Kerberos基于资源的约束委派（RBCD），具体细节尚未公开。

官方通告链接：

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1674

3影响范围

以下为重点关注漏洞的受影响产品版本，其他漏洞影响产品范围请参阅官方通告链接。

漏洞编号

受影响产品版本

CVE-2021-1647

Windows 10 Version 1607 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows 10 for x64-based SystemsWindows 10 for 32-bit SystemsWindows Server, version 20H2 (Server Core Installation)Windows 10 Version 20H2 for ARM64-based SystemsWindows 10 Version 20H2 for 32-bit SystemsWindows 10 Version 20H2 for x64-based SystemsWindows Server, version 2004 (Server Core installation)Windows 10 Version 2004 for x64-based SystemsWindows 10 Version 2004 for ARM64-based SystemsWindows 10 Version 2004 for 32-bit SystemsWindows Server, version 1909 (Server Core installation)Windows 10 Version 1909 for ARM64-based SystemsWindows 10 Version 1909 for x64-based SystemsWindows 10 Version 1909 for 32-bit SystemsWindows Server 2019 (Server Core installation)Windows Server 2019Windows 10 Version 1809 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows 10 Version 1809 for 32-bit SystemsWindows 10 Version 1803 for ARM64-based SystemsWindows 10 Version 1803 for x64-based SystemsWindows 10 Version 1803 for 32-bit SystemsWindows Server 2012 R2 (Server Core installation)Windows Server 2012 R2Windows Server 2012 (Server Core installation)Windows Server 2012Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows Server 2008 R2 for x64-based Systems Service Pack 1Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Windows Server 2008 for 32-bit Systems Service Pack 2Windows RT 8.1Windows 8.1 for x64-based systemsWindows 8.1 for 32-bit systemsWindows 7 for x64-based Systems Service Pack 1Windows 7 for 32-bit Systems Service Pack 1Windows Server 2016 (Server Core installation)Windows Server 2016

CVE-2021-1648

Windows 10 Version 20H2 for ARM64-based SystemsWindows 10 Version 20H2 for 32-bit SystemsWindows Server, version 20H2 (Server Core Installation)Windows 10 Version 20H2 for x64-based SystemsWindows Server 2012 R2 (Server Core installation)Windows Server 2012 R2Windows Server 2012 (Server Core installation)Windows Server 2012Windows RT 8.1Windows 8.1 for x64-based systemsWindows 8.1 for 32-bit systemsWindows Server 2016 (Server Core installation)Windows Server 2016Windows 10 Version 1607 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows 10 for x64-based SystemsWindows 10 for 32-bit SystemsWindows Server, version 2004 (Server Core installation)Windows 10 Version 2004 for x64-based SystemsWindows 10 Version 2004 for ARM64-based SystemsWindows 10 Version 2004 for 32-bit SystemsWindows Server, version 1909 (Server Core installation)Windows 10 Version 1909 for ARM64-based SystemsWindows 10 Version 1909 for x64-based SystemsWindows 10 Version 1909 for 32-bit SystemsWindows Server 2019 (Server Core installation)Windows Server 2019Windows 10 Version 1809 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows 10 Version 1809 for 32-bit SystemsWindows 10 Version 1803 for ARM64-based SystemsWindows 10 Version 1803 for x64-based SystemsWindows 10 Version 1803 for 32-bit Systems

CVE-2021-1707

Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft SharePoint Server 2019Microsoft SharePoint Enterprise Server 2016

CVE-2021-1709

Windows 10 Version 2004 for 32-bit SystemsWindows Server, version 1909 (Server Core installation)Windows 10 Version 1909 for ARM64-based SystemsWindows 10 Version 1909 for x64-based SystemsWindows 10 Version 1909 for 32-bit SystemsWindows Server 2019 (Server Core installation)Windows Server 2019Windows 10 Version 1809 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows 10 Version 1809 for 32-bit SystemsWindows 10 Version 1803 for ARM64-based SystemsWindows 10 Version 1803 for x64-based SystemsWindows 10 Version 2004 for ARM64-based SystemsWindows Server 2012 R2 (Server Core installation)Windows Server 2012 R2Windows Server 2012 (Server Core installation)Windows Server 2012Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows Server, version 2004 (Server Core installation)Windows 10 Version 2004 for x64-based SystemsWindows 10 Version 1803 for 32-bit SystemsWindows Server, version 20H2 (Server Core Installation)Windows 10 Version 20H2 for ARM64-based SystemsWindows 10 Version 20H2 for 32-bit SystemsWindows 10 Version 20H2 for x64-based SystemsWindows Server 2008 R2 for x64-based Systems Service Pack 1Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Windows Server 2008 for 32-bit Systems Service Pack 2Windows RT 8.1Windows 8.1 for x64-based systemsWindows 8.1 for 32-bit systemsWindows 7 for x64-based Systems Service Pack 1Windows 7 for 32-bit Systems Service Pack 1Windows Server 2016 (Server Core installation)Windows Server 2016Windows 10 Version 1607 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows 10 for x64-based SystemsWindows 10 for 32-bit Systems

CVE-2021-1665

Windows Server 2012 R2Windows Server 2012 (Server Core installation)Windows Server 2012Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows Server 2008 R2 for x64-based Systems Service Pack 1Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Windows Server 2008 for 32-bit Systems Service Pack 2Windows RT 8.1Windows Server, version 20H2 (Server Core Installation)Windows 10 Version 20H2 for ARM64-based SystemsWindows 10 Version 20H2 for 32-bit SystemsWindows 10 Version 20H2 for x64-based SystemsWindows Server 2012 R2 (Server Core installation)Windows 8.1 for x64-based systemsWindows 10 for x64-based SystemsWindows 8.1 for 32-bit systemsWindows 7 for x64-based Systems Service Pack 1Windows 7 for 32-bit Systems Service Pack 1Windows Server 2016 (Server Core installation)Windows Server 2016Windows 10 Version 1607 for 32-bit SystemsWindows 10 Version 1607 for x64-based SystemsWindows 10 for 32-bit SystemsWindows Server, version 2004 (Server Core installation)Windows 10 Version 2004 for x64-based SystemsWindows 10 Version 2004 for ARM64-based SystemsWindows 10 Version 2004 for 32-bit SystemsWindows Server, version 1909 (Server Core installation)Windows 10 Version 1909 for ARM64-based SystemsWindows 10 Version 1909 for x64-based SystemsWindows 10 Version 1909 for 32-bit SystemsWindows Server 2019 (Server Core installation)Windows Server 2019Windows 10 Version 1809 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows 10 Version 1809 for 32-bit SystemsWindows 10 Version 1803 for ARM64-based SystemsWindows 10 Version 1803 for x64-based SystemsWindows 10 Version 1803 for 32-bit Systems

CVE-2021-1674

Windows 7 for x64-based Systems Service Pack 1Windows 7 for 32-bit Systems Service Pack 1Windows Server 2016 (Server Core installation)Windows Server 2016Windows 10 Version 1607 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows 10 for x64-based SystemsWindows 10 for 32-bit SystemsWindows Server, version 2004 (Server Core installation)Windows 10 Version 2004 for x64-based SystemsWindows 10 Version 2004 for ARM64-based SystemsWindows 10 Version 2004 for 32-bit SystemsWindows Server, version 1909 (Server Core installation)Windows 10 Version 1909 for ARM64-based SystemsWindows 10 Version 1909 for x64-based SystemsWindows 10 Version 1909 for 32-bit SystemsWindows Server 2019 (Server Core installation)Windows Server 2019Windows 10 Version 1809 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows 8.1 for 32-bit systemsWindows Server 2012 R2 (Server Core installation)Windows Server 2012 R2Windows Server 2012 (Server Core installation)Windows Server 2012Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows Server 2008 R2 for x64-based Systems Service Pack 1Windows RT 8.1Windows 8.1 for x64-based systemsWindows 10 Version 1809 for 32-bit Systems

4漏洞防护

4.1 补丁更新

目前微软官方已针对受支持的产品版本发布了修复以上漏洞的安全补丁，强烈建议受影响用户尽快安装补丁进行防护，官方下载链接：

https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jan

注：由于网络问题、计算机环境问题等原因，Windows Update的补丁更新可能出现失败。用户在安装补丁后，应及时检查补丁是否成功更新。

右键点击Windows图标，选择“设置(N)”，选择“更新和安全”-“Windows更新”，查看该页面上的提示信息，也可点击“查看更新历史记录”查看历史更新情况。

针对未成功安装的更新，可点击更新名称跳转到微软官方下载页面，建议用户点击该页面上的链接，转到“Microsoft更新目录”网站下载独立程序包并安装。

附录：漏洞列表

影响产品

CVE 编号

漏洞标题

严重程度

Microsoft DTV-DVD Video Decoder

CVE-2021-1668

Microsoft DTV-DVD Video Decoder 远程代码执行漏洞

Critical

Microsoft Graphics Component

CVE-2021-1665

GDI 远程代码执行漏洞

Critical

Microsoft Malware Protection Engine

CVE-2021-1647

Microsoft Defender 远程代码执行漏洞

Critical

Microsoft Windows Codecs Library

CVE-2021-1643

HEVC Video Extensions 远程代码执行漏洞

Critical

Windows Remote Procedure Call Runtime

CVE-2021-1658

Remote Procedure Call Runtime 远程代码执行漏洞

Critical

Windows Remote Procedure Call Runtime

CVE-2021-1660

Remote Procedure Call Runtime 远程代码执行漏洞

Critical

Windows Remote Procedure Call Runtime

CVE-2021-1666

Remote Procedure Call Runtime 远程代码执行漏洞

Critical

Windows Remote Procedure Call Runtime

CVE-2021-1667

Remote Procedure Call Runtime 远程代码执行漏洞

Critical

Windows Remote Procedure Call Runtime

CVE-2021-1673

Remote Procedure Call Runtime 远程代码执行漏洞

Critical

.NET Repository

CVE-2021-1725

Bot Framework SDK 信息泄露漏洞

Important

ASP.NET core & .NET core

CVE-2021-1723

ASP.NET Core and Visual Studio 拒绝服务漏洞

Important

Azure Active Directory Pod Identity

CVE-2021-1677

Azure Active Directory Pod Identity 欺骗漏洞

Important

Microsoft Bluetooth Driver

CVE-2021-1683

Windows Bluetooth 安全功能绕过漏洞

Important

Microsoft Bluetooth Driver

CVE-2021-1684

Windows Bluetooth 安全功能绕过漏洞

Important

Microsoft Bluetooth Driver

CVE-2021-1638

Windows Bluetooth 安全功能绕过漏洞

Important

Microsoft Graphics Component

CVE-2021-1696

Windows Graphics Component 信息泄露漏洞

Important

Microsoft Graphics Component

CVE-2021-1708

Windows GDI 信息泄露漏洞

Important

Microsoft Graphics Component

CVE-2021-1709

Windows Win32k 特权提升漏洞

Important

Microsoft Office

CVE-2021-1711

Microsoft Office 远程代码执行漏洞

Important

Microsoft Office

CVE-2021-1713

Microsoft Excel 远程代码执行漏洞

Important

Microsoft Office

CVE-2021-1714

Microsoft Excel 远程代码执行漏洞

Important

Microsoft Office

CVE-2021-1715

Microsoft Word 远程代码执行漏洞

Important

Microsoft Office

CVE-2021-1716

Microsoft Word 远程代码执行漏洞

Important

Microsoft Office SharePoint

CVE-2021-1641

Microsoft SharePoint 欺骗漏洞

Important

Microsoft Office SharePoint

CVE-2021-1707

Microsoft SharePoint Server 远程代码执行漏洞

Important

Microsoft Office SharePoint

CVE-2021-1712

Microsoft SharePoint 特权提升漏洞

Important

Microsoft Office SharePoint

CVE-2021-1718

Microsoft SharePoint Server Tampering Vulnerability

Important

Microsoft Office SharePoint

CVE-2021-1717

Microsoft SharePoint 欺骗漏洞

Important

Microsoft Office SharePoint

CVE-2021-1719

Microsoft SharePoint 特权提升漏洞

Important

Microsoft RPC

CVE-2021-1702

Windows Remote Procedure Call Runtime 特权提升漏洞

Important

Microsoft Windows

CVE-2021-1657

Windows Fax Compose Form 远程代码执行漏洞

Important

Microsoft Windows

CVE-2021-1676

Windows NT Lan Manager Datagram Receiver Driver 信息泄露漏洞

Important

Microsoft Windows

CVE-2021-1689

Windows Multipoint Management 特权提升漏洞

Important

Microsoft Windows

CVE-2021-1650

Windows Runtime C Template Library 特权提升漏洞

Important

Microsoft Windows

CVE-2021-1649

Active Template Library 特权提升漏洞

Important

Microsoft Windows

CVE-2021-1646

Windows WLAN Service 特权提升漏洞

Important

Microsoft Windows

CVE-2021-1699

Windows (modem.sys) 信息泄露漏洞

Important

Microsoft Windows

CVE-2021-1706

Windows LUAFV 特权提升漏洞

Important

Microsoft Windows Codecs Library

CVE-2021-1644

HEVC Video Extensions 远程代码执行漏洞

Important

Microsoft Windows DNS

CVE-2021-1637

Windows DNS Query 信息泄露漏洞

Important

SQL Server

CVE-2021-1636

Microsoft SQL 特权提升漏洞

Important

Visual Studio

CVE-2020-26870

Visual Studio 远程代码执行漏洞

Important

Windows AppX Deployment Extensions

CVE-2021-1642

Windows AppX Deployment Extensions 特权提升漏洞

Important

Windows AppX Deployment Extensions

CVE-2021-1685

Windows AppX Deployment Extensions 特权提升漏洞

Important

Windows CryptoAPI

CVE-2021-1679

Windows CryptoAPI 拒绝服务漏洞

Important

Windows CSC Service

CVE-2021-1652

Windows CSC Service 特权提升漏洞

Important

Windows CSC Service

CVE-2021-1653

Windows CSC Service 特权提升漏洞

Important

Windows CSC Service

CVE-2021-1654

Windows CSC Service 特权提升漏洞

Important

Windows CSC Service

CVE-2021-1655

Windows CSC Service 特权提升漏洞

Important

Windows CSC Service

CVE-2021-1659

Windows CSC Service 特权提升漏洞

Important

Windows CSC Service

CVE-2021-1688

Windows CSC Service 特权提升漏洞

Important

Windows CSC Service

CVE-2021-1693

Windows CSC Service 特权提升漏洞

Important

Windows Diagnostic Hub

CVE-2021-1651

Diagnostics Hub Standard Collector 特权提升漏洞

Important

Windows Diagnostic Hub

CVE-2021-1680

Diagnostics Hub Standard Collector 特权提升漏洞

Important

Windows DP API

CVE-2021-1645

Windows Docker 信息泄露漏洞

Important

Windows Event Logging Service

CVE-2021-1703

Windows Event Logging Service 特权提升漏洞

Important

Windows Event Tracing

CVE-2021-1662

Windows Event Tracing 特权提升漏洞

Important

Windows Hyper-V

CVE-2021-1691

Hyper-V 拒绝服务漏洞

Important

Windows Hyper-V

CVE-2021-1692

Hyper-V 拒绝服务漏洞

Important

Windows Hyper-V

CVE-2021-1704

Windows Hyper-V 特权提升漏洞

Important

Windows Installer

CVE-2021-1661

Windows Installer 特权提升漏洞

Important

Windows Installer

CVE-2021-1697

Windows InstallService 特权提升漏洞

Important

Windows Kernel

CVE-2021-1682

Windows Kernel 特权提升漏洞

Important

Windows Media

CVE-2021-1710

Microsoft Windows Media Foundation 远程代码执行漏洞

Important

Windows NTLM

CVE-2021-1678

NTLM 安全功能绕过漏洞

Important

Windows Print Spooler Components

CVE-2021-1695

Windows Print Spooler 特权提升漏洞

Important

Windows Projected File System Filter Driver

CVE-2021-1663

Windows Projected File System FS Filter Driver 信息泄露漏洞

Important

Windows Projected File System Filter Driver

CVE-2021-1670

Windows Projected File System FS Filter Driver 信息泄露漏洞

Important

Windows Projected File System Filter Driver

CVE-2021-1672

Windows Projected File System FS Filter Driver 信息泄露漏洞

Important

Windows Remote Desktop

CVE-2021-1669

Windows Remote Desktop 安全功能绕过漏洞

Important

Windows Remote Desktop

CVE-2021-1674

Windows Remote Desktop Protocol Core 安全功能绕过漏洞

Important

Windows Remote Procedure Call Runtime

CVE-2021-1664

Remote Procedure Call Runtime 远程代码执行漏洞

Important

Windows Remote Procedure Call Runtime

CVE-2021-1671

Remote Procedure Call Runtime 远程代码执行漏洞

Important

Windows Remote Procedure Call Runtime

CVE-2021-1700

Remote Procedure Call Runtime 远程代码执行漏洞

Important

Windows Remote Procedure Call Runtime

CVE-2021-1701

Remote Procedure Call Runtime 远程代码执行漏洞

Important

Windows splwow64

CVE-2021-1648

Microsoft splwow64 特权提升漏洞

Important

Windows TPM Device Driver

CVE-2021-1656

TPM Device Driver 信息泄露漏洞

Important

Windows Update Stack

CVE-2021-1694

Windows Update Stack 特权提升漏洞

Important

Windows WalletService

CVE-2021-1681

Windows WalletService 特权提升漏洞

Important

Windows WalletService

CVE-2021-1686

Windows WalletService 特权提升漏洞

Important

Windows WalletService

CVE-2021-1687

Windows WalletService 特权提升漏洞

Important

Windows WalletService

CVE-2021-1690

Windows WalletService 特权提升漏洞

Important

Microsoft Edge (HTML-based)

CVE-2021-1705

Microsoft Edge (HTML-based) 内存破坏漏洞

Moderate

END

作者：绿盟科技威胁对抗能力部

声明

本安全公告仅用来描述可能存在的安全问题，绿盟科技不为此安全公告提供任何保证或承诺。由于传播、利用此安全公告所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，绿盟科技以及安全公告作者不为此承担任何责任。

绿盟科技拥有对此安全公告的修改和解释权。如欲转载或传播此安全公告，必须保证此安全公告的完整性，包括版权声明等全部内容。未经绿盟科技允许，不得任意修改或者增减此安全公告内容，不得以任何方式将其用于商业目的。

windows windowsserver sqlserver 数据库 sql

0 人点赞