CNNVD關(guān)于微軟多個安全漏洞的預(yù)警
CNNVD 2022-03-11
近日，微軟官方發(fā)布了多個安全漏洞的公告，其中微軟產(chǎn)品本身漏洞72個，影響到微軟產(chǎn)品的其他廠商漏洞2個。包括OpenSSL 緩沖區(qū)錯誤漏洞（CNNVD-202108-1945、CVE-2021-3711）、Microsoft WindowsMedia Foundation權(quán)限許可和訪問控制問題漏洞（CNNVD-202108-841、CVE-2021-36927）等多個漏洞。成功利用上述漏洞的攻擊者可以在目標(biāo)系統(tǒng)上執(zhí)行任意代碼、獲取用戶數(shù)據(jù)，提升權(quán)限等。微軟多個產(chǎn)品和系統(tǒng)受漏洞影響。目前，微軟官方已經(jīng)發(fā)布了漏洞修復(fù)補丁，建議用戶及時確認(rèn)是否受到漏洞影響，盡快采取修補措施。
一、 漏洞介紹
2022年3月9日，微軟發(fā)布了2022年3月份安全更新，共74個漏洞的補丁程序，CNNVD對這些漏洞進行了收錄。本次更新主要涵蓋了Microsoft Windows 和Windows 組件、Microsoft Skype Extensionfor Chrome、Microsoft Windows CD-ROM Driver、Microsoft HEIF Image Extensions、MicrosoftOffice Visio、Microsoft Windows Fastfat Driver等。CNNVD對其危害等級進行了評價，其中超危漏洞1個，高危漏洞52個，中危漏洞19個，低危漏洞2個。微軟多個產(chǎn)品和系統(tǒng)版本受漏洞影響，具體影響范圍可訪問
https://portal.msrc.microsoft.com/zh-cn/security-guidance查詢。
二、漏洞詳情
此次更新共包括72個漏洞的補丁程序，其中高危漏洞52個，中危漏洞18個，低危漏洞2個。
|
序號 |
漏洞名稱 |
CNNVD編號 |
CVE編號 |
危害等級 |
官方鏈接 |
|
1 |
Microsoft Windows Media Foundation權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202108-841 |
CVE-2021-36927 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36927 |
|
2 |
Microsoft Dynamics 代碼注入漏洞 |
CNNVD-202202-696 |
CVE-2022-21957 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21957 |
|
3 |
Microsoft XBox 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-695 |
CVE-2022-21967 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21967 |
|
4 |
Microsoft Remote Desktop Client 代碼注入漏洞 |
CNNVD-202203-691 |
CVE-2022-21990 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21990 |
|
5 |
Microsoft HEVC Video Extensions 代碼注入漏洞 |
CNNVD-202203-734 |
CVE-2022-22006 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22006 |
|
6 |
Microsoft HEVC Video Extensions 代碼注入漏洞 |
CNNVD-202203-732 |
CVE-2022-22007 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22007 |
|
7 |
Microsoft Defender for IoT 代碼注入漏洞 |
CNNVD-202203-751 |
CVE-2022-23265 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23265 |
|
8 |
Microsoft Defender 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-753 |
CVE-2022-23266 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23266 |
|
9 |
Microsoft Exchange Server 代碼注入漏洞 |
CNNVD-202203-708 |
CVE-2022-23277 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23277 |
|
10 |
Microsoft Paint 3D 代碼注入漏洞 |
CNNVD-202203-711 |
CVE-2022-23282 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23282 |
|
11 |
Microsoft Windows ALPC 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-682 |
CVE-2022-23283 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23283 |
|
12 |
Microsoft Windows Print Spooler Components 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-685 |
CVE-2022-23284 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23284 |
|
13 |
Microsoft Remote Desktop Client 代碼注入漏洞 |
CNNVD-202203-679 |
CVE-2022-23285 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23285 |
|
14 |
Microsoft Windows Cloud Files Mini Filter Driver 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-681 |
CVE-2022-23286 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23286 |
|
15 |
Microsoft Windows ALPC 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-680 |
CVE-2022-23287 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23287 |
|
16 |
Microsoft DWM Core Library 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-678 |
CVE-2022-23288 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23288 |
|
17 |
Microsoft Windows COM 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-687 |
CVE-2022-23290 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23290 |
|
18 |
Microsoft DWM Core Library 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-683 |
CVE-2022-23291 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23291 |
|
19 |
Microsoft Windows Fastfat Driver 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-675 |
CVE-2022-23293 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23293 |
|
20 |
Microsoft Windows Event Tracing 代碼注入漏洞 |
CNNVD-202203-676 |
CVE-2022-23294 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23294 |
|
21 |
Microsoft Raw Image Extension 代碼注入漏洞 |
CNNVD-202203-742 |
CVE-2022-23295 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23295 |
|
22 |
Microsoft Windows Installer 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-677 |
CVE-2022-23296 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23296 |
|
23 |
Microsoft Windows NT OS Kernel 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-674 |
CVE-2022-23298 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23298 |
|
24 |
Microsoft Windows PDEV 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-671 |
CVE-2022-23299 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23299 |
|
25 |
Microsoft Raw Image Extension 代碼注入漏洞 |
CNNVD-202203-741 |
CVE-2022-23300 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23300 |
|
26 |
Microsoft HEVC Video Extensions 代碼注入漏洞 |
CNNVD-202203-731 |
CVE-2022-23301 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23301 |
|
27 |
Microsoft VP9 Video Extensions 代碼注入漏洞 |
CNNVD-202203-760 |
CVE-2022-24451 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24451 |
|
28 |
Microsoft HEVC Video Extensions 代碼注入漏洞 |
CNNVD-202203-737 |
CVE-2022-24452 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24452 |
|
29 |
Microsoft HEVC Video Extensions 代碼注入漏洞 |
CNNVD-202203-733 |
CVE-2022-24453 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24453 |
|
30 |
Microsoft Windows Security Account Manager 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-670 |
CVE-2022-24454 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24454 |
|
31 |
Microsoft Windows CD-ROM Driver 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-672 |
CVE-2022-24455 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24455 |
|
32 |
Microsoft HEVC Video Extensions 代碼注入漏洞 |
CNNVD-202203-738 |
CVE-2022-24456 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24456 |
|
33 |
Microsoft HEIF Image Extensions 代碼注入漏洞 |
CNNVD-202203-764 |
CVE-2022-24457 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24457 |
|
34 |
Microsoft Windows Fax and Scan Service 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-667 |
CVE-2022-24459 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24459 |
|
35 |
Microsoft Tablet Windows User Interface 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-668 |
CVE-2022-24460 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24460 |
|
36 |
Microsoft Office Visio 代碼注入漏洞 |
CNNVD-202203-727 |
CVE-2022-24461 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24461 |
|
37 |
Microsoft .NET Core和Microsoft Visual Studio 輸入驗證錯誤漏洞 |
CNNVD-202203-701 |
CVE-2022-24464 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464 |
|
38 |
Microsoft Azure Site Recovery 代碼注入漏洞 |
CNNVD-202203-725 |
CVE-2022-24467 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24467 |
|
39 |
Microsoft Azure Site Recovery 代碼注入漏洞 |
CNNVD-202203-722 |
CVE-2022-24468 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24468 |
|
40 |
Microsoft Azure Site Recovery 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-724 |
CVE-2022-24469 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24469 |
|
41 |
Microsoft Azure Site Recovery 代碼注入漏洞 |
CNNVD-202203-720 |
CVE-2022-24470 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24470 |
|
42 |
Microsoft Azure Site Recovery 代碼注入漏洞 |
CNNVD-202203-719 |
CVE-2022-24471 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24471 |
|
43 |
Microsoft VP9 Video Extensions 代碼注入漏洞 |
CNNVD-202203-767 |
CVE-2022-24501 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24501 |
|
44 |
Microsoft Windows ALPC 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-669 |
CVE-2022-24505 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24505 |
|
45 |
Microsoft Windows Ancillary Function Driver for WinSock 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-665 |
CVE-2022-24507 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24507 |
|
46 |
Microsoft SMBv3 代碼注入漏洞 |
CNNVD-202203-661 |
CVE-2022-24508 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24508 |
|
47 |
Microsoft Office Visio 代碼注入漏洞 |
CNNVD-202203-714 |
CVE-2022-24509 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24509 |
|
48 |
Microsoft Office Visio 代碼注入漏洞 |
CNNVD-202203-713 |
CVE-2022-24510 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24510 |
|
49 |
Microsoft Azure Site Recovery 代碼注入漏洞 |
CNNVD-202203-716 |
CVE-2022-24517 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24517 |
|
50 |
Microsoft Azure Site Recovery 代碼注入漏洞 |
CNNVD-202203-718 |
CVE-2022-24520 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24520 |
|
51 |
Microsoft Skype Extension for Chrome 信息泄露漏洞 |
CNNVD-202203-728 |
CVE-2022-24522 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24522 |
|
52 |
Microsoft Windows Update 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-659 |
CVE-2022-24525 |
高危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24525 |
|
53 |
Microsoft Windows Media 輸入驗證錯誤漏洞 |
CNNVD-202203-697 |
CVE-2022-21973 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21973 |
|
54 |
Microsoft Hyper-V 輸入驗證錯誤漏洞 |
CNNVD-202203-693 |
CVE-2022-21975 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21975 |
|
55 |
Microsoft Windows Media Foundation 緩沖區(qū)錯誤漏洞 |
CNNVD-202203-689 |
CVE-2022-22010 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22010 |
|
56 |
Microsoft Windows Point-to-Point Tunneling Protocol 輸入驗證錯誤漏洞 |
CNNVD-202203-684 |
CVE-2022-23253 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23253 |
|
57 |
Microsoft Defender 安全漏洞 |
CNNVD-202203-717 |
CVE-2022-23278 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23278 |
|
58 |
Microsoft Windows Common Log File System Driver 信息泄露漏洞 |
CNNVD-202203-686 |
CVE-2022-23281 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23281 |
|
59 |
Microsoft NT LAN Manager 信息泄露漏洞 |
CNNVD-202203-673 |
CVE-2022-23297 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23297 |
|
60 |
Microsoft Word 安全特征問題漏洞 |
CNNVD-202203-726 |
CVE-2022-24462 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24462 |
|
61 |
Microsoft Exchange Server 信息泄露漏洞 |
CNNVD-202203-700 |
CVE-2022-24463 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24463 |
|
62 |
Microsoft Windows HTML Platform 安全特征問題漏洞 |
CNNVD-202203-664 |
CVE-2022-24502 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24502 |
|
63 |
Microsoft Remote Desktop Protocol Client 緩沖區(qū)錯誤漏洞 |
CNNVD-202203-666 |
CVE-2022-24503 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24503 |
|
64 |
Microsoft Azure Site Recovery 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-715 |
CVE-2022-24506 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24506 |
|
65 |
Microsoft Word 輸入驗證錯誤漏洞 |
CNNVD-202203-710 |
CVE-2022-24511 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24511 |
|
66 |
Microsoft .NET Core和Microsoft Visual Studio 代碼注入漏洞 |
CNNVD-202203-699 |
CVE-2022-24512 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512 |
|
67 |
Microsoft Azure Site Recovery 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-721 |
CVE-2022-24515 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24515 |
|
68 |
Microsoft Azure Site Recovery 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-729 |
CVE-2022-24518 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24518 |
|
69 |
Microsoft Azure Site Recovery 權(quán)限許可和訪問控制問題漏洞 |
CNNVD-202203-723 |
CVE-2022-24519 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24519 |
|
70 |
Microsoft Visual Studio Code 安全漏洞 |
CNNVD-202203-730 |
CVE-2022-24526 |
中危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24526 |
|
71 |
Microsoft Windows Media Foundation 緩沖區(qū)錯誤漏洞 |
CNNVD-202203-692 |
CVE-2022-21977 |
低危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21977 |
|
72 |
Microsoft Intune 安全特征問題漏洞 |
CNNVD-202203-773 |
CVE-2022-24465 |
低危 |
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24465 |
此次更新共包括2個影響微軟產(chǎn)品的其他廠商漏洞的補丁程序，其中超危漏洞1個中危漏洞1個。
|
序號 |
漏洞名稱 |
CNNVD編號 |
CVE編號 |
危害等級 |
廠商 |
官方鏈接 |
|
1 |
OpenSSL 緩沖區(qū)錯誤漏洞 |
CNNVD-202108-1945 |
CVE-2021-3711 |
超危 |
Openssl團隊 |
https://git.openssl.org/?p=openssl.git;a=summary |
|
2 |
Google brotli Library 緩沖區(qū)錯誤漏洞 |
CNNVD-202009-910 |
CVE-2020-8927 |
中危 |
|
https://github.com/google/brotli/releases/tag/v1.0 |
三、修復(fù)建議
目前，微軟官方已經(jīng)發(fā)布補丁修復(fù)了上述漏洞，建議用戶及時確認(rèn)漏洞影響，盡快采取修補措施。微軟官方補丁下載地址：https://msrc.microsoft.com/update-guide/en-us
