九游老哥云
【清静通告】微软6月清静更新多个产品高危误差通告
2021-06-10
一. 误差概述
6月9日，九游老哥科技CERT监测到微软宣布6月清静更新补丁，修复了50个清静误差，涉及Windows、Microsoft Office、Microsoft Edge、Visual Studio 、SharePoint Server等普遍使用的产品，其中包括远程代码执行和权限提升等高危误差类型。
本月微软月度更新修复的误差中，严重水平为要害（Critical）的误差有5个，主要（Important）误差有45个。请相关用户尽快更新补丁举行防护。完整误差列表请参考附录。
九游老哥远程清静评估系统（RSAS）已具备微软此次补丁更新中大大都误差的检测能力（包括CVE-2021-31959、CVE-2021-31963、CVE-2021-33742等高危误差），请相关用户关注九游老哥远程清静评估系统系统插件升级包的更新，实时升级至V6.0R02F01.2305，官网链接：http://update.nsfocus.com/update/listRsasDetail/v/vulsys。
参考链接：
https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jun
二. 重点误差简述
凭证产品盛行度和误差主要性筛选出此次更新中包括影响较大的误差，请相关用户重点举行关注：
Windows MSHTML Platform 远程代码执行误差（CVE-2021-33742）：
Windows MSHTML Platform保存远程代码执行误差，该误差由MSHTML的渲染引擎 Trident导致，未授权的远程攻击者可通过诱导用户翻开特制文件或会见恶意网站举行使用，从而控制用户盘算机系统，现在此误差已发明在野使用。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33742
Microsoft Defender 远程代码执行误差（CVE-2021-31985）：
Microsoft Defender保存远程代码执行误差，该误差可绕过Defender的防御战略，攻击者通过结构特制的二进制程序并诱导用户翻开，即可在目的系统上执行恣意代码。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31985
Microsoft SharePoint Server 远程代码执行误差（CVE-2021-31963）：
Microsoft SharePoint Server保存远程代码执行误差，经由身份认证的攻击者可通过结构恶意http请求执行反序列化攻击，从而接受目的服务器。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31963
Kerberos AppContainer 清静功效绕过误差（CVE-2021-31962）：
Kerberos AppContainer 保存清静功效绕过误差，此误差允许攻击者绕过 Kerberos 身份验证，对恣意服务主体名称举行身份验证。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31962
Windows Print Spooler 权限提升误差（CVE-2021-1675）：
Windows Print Spooler 保存权限提升误差，Print Spooler是Windows系统中用于治理打印相关事务的服务，微软在通告中将该误差标记为Important级别的外地权限提升误差，但现实上在域情形中合适的条件下，无需任何用户交互，未授权的远程攻击者就可以使用该误差以SYSTEM权限在域控制器上执行恣意代码。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675
Microsoft Enhanced Cryptographic Provider 权限提升误差（CVE-2021-31199/CVE-2021-31201）：
Microsoft Enhanced Cryptographic Provider保存两个权限提升误差（CVE-2021-31199/CVE-2021-31201），外地攻击者可以绕过Microsoft Enhanced Cryptographic Provider的清静限制读取和修改受限制的信息。这两个误差被攻击者用于与Adobe Reader的误差（CVE-2021-28550）团结使用，攻击者通过诱导用户翻开特制的 PDF文件，从而实现远程恣意代码执行。现在已发明在野使用。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31199
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31201
Windows NTFS 权限提升误差（CVE-2021-31956）：
Windows NTFS保存权限提升误差，此误差为ntfs.sys 中基于堆的缓冲区溢出误差，经由身份认证的攻击者可通过运行特制的程序举行系统提权。攻击者通常通过诱导用户翻开特制的文件来使用此误差。该误差由卡巴斯基的研究职员发明，并将其关联到PuzzleMaker Group，该组织将此误差与Windows Kernel信息泄露误差（CVE-2021-31955）以及Chrome远程代码执行误差团结使用，可实现Chrome沙箱逃逸并获取目的系统权限。现在已发明在野使用。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31956
Microsoft DWM Core Library 权限提升误差（CVE-2021-33739）：
Microsoft DWM Core Library保存权限提升误差，经由身份认证的攻击者可通过运行特制的程序举行提权。攻击者通常通过诱导用户翻开特制的文件来使用此误差。现在该误差细节已果真，且已发明在野使用。
官方通告链接：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33739
三. 影响规模
以下为重点关注误差的受影响产品版本，其他误差影响产品规模请参阅官方通告链接。
|
误差编号 |
受影响产品版本 |
|
CVE-2021-33742 |
Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows RT 8.1 Windows 8.1 for x64-based systems Windows 8.1 for 32-bit systems Windows 7 for x64-based Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows 10 Version 2004 for x64-based Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
|
CVE-2021-31985 |
Microsoft Malware Protection Engine < 1.1.18200.3 |
|
CVE-2021-31963 |
Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 |
|
CVE-2021-31962 CVE-2021-1675 CVE-2021-31199 CVE-2021-31201 CVE-2021-31956 |
Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows RT 8.1 Windows 8.1 for x64-based systems Windows 8.1 for 32-bit systems Windows 7 for x64-based Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows Server, version 20H2 (Server Core Installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server, version 2004 (Server Core installation) Windows 10 Version 2004 for x64-based Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
|
CVE-2021-33739 |
Windows Server, version 20H2 (Server Core Installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server, version 2004 (Server Core installation) Windows 10 Version 2004 for x64-based Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems |
四. 误差防护
4.1 补丁更新
现在微软官方已针对受支持的产品版本宣布了修复以上误差的清静补丁，强烈建议受影响用户尽快装置补丁举行防护，官方下载链接：
https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jun
注：由于网络问题、盘算机情形问题等缘故原由，Windows Update的补丁更新可能泛起失败。用户在装置补丁后，应实时检查补丁是否乐成更新。
右键点击Windows图标，选择“设置(N)”，选择“更新和清静”-“Windows更新”，审查该页面上的提醒信息，也可点击“审查更新历史纪录”审查历史更新情形。
针对未乐成装置的更新，可点击更新名称跳转到微软官方下载页面，建议用户点击该页面上的链接，转到“Microsoft更新目录”网站下载自力程序包并装置。
