正文

【安全更新】微软8月安全更新多个产品高危漏洞通告

admin
admin V管理员 /0 评论 /190 阅读
0313
此篇文章发布距今已超过622天，您需要注意文章的内容或图片是否可用！

通告编号:NS-2022-0023

2022-08-10
TAG：

安全更新、Windows、Azure、Active Directory、Exchange Server、Hyper-V

漏洞危害：

攻击者利用本次安全更新中的漏洞，可造成权限提升、远程代码执行、敏感信息泄露等。

版本：1.0

1

漏洞概述

8月10日，绿盟科技CERT监测到微软发布8月安全更新补丁，修复了121个安全问题，涉及Windows Print Spooler、Hyper-V、Azure、Exchange、Kernel 等广泛使用的产品，其中包括权限提升、远程代码执行等高危漏洞类型。

本月微软月度更新修复的漏洞中，严重程度为关键（Critical）的漏洞有17个，重要（Important）漏洞有104个，其中包括2个0day漏洞：

Microsoft Windows 支持诊断工具 (MSDT) 远程代码执行漏洞（CVE-2022-34713）

Microsoft Exchange 信息泄露漏洞（CVE-2022-30134）

请相关用户尽快更新补丁进行防护，完整漏洞列表请参考附录。

绿盟远程安全评估系统（RSAS）已具备微软此次补丁更新中大部分漏洞的检测能力（包括CVE-2022-34713、CVE-2022-30134、CVE-2022-35767、CVE-2022-34691、CVE-2022-35744等高危漏洞），请相关用户关注绿盟远程安全评估系统系统插件升级包的更新，及时升级至V6.0R02F01.2809，官网链接：http://update.nsfocus.com/update/listRsasDetail/v/vulsys


参考链接：

https://msrc.microsoft.com/update-guide/releaseNote/2022-Aug

SEE MORE →   

2重点漏洞简述

根据产品流行度和漏洞重要性筛选出此次更新中包含影响较大的漏洞，请相关用户重点进行关注：

Microsoft Windows 支持诊断工具 (MSDT) 远程代码执行漏洞（CVE-2022-34713）：

MSDT（Microsoft 支持诊断工具）是内置于 Windows 操作系统中的诊断和故障排除工具。无需身份验证的本地攻击者通过制作恶意文件，当成功诱导用户在受影响的系统上打开恶意文件后，可在目标系统上以该用户权限执行任意代码。CVSS分数为7.8。目前，该漏洞PoC及技术细节已被披露，且已监测到在野利用。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713


Microsoft Exchange 敏感信息泄露漏洞（CVE-2022-30134）：

Microsoft Exchange中存在敏感信息泄露漏洞，具有低权限的远程攻击者成功利用该漏洞可读取目标系统的电子邮件信息，且无需用户交互。微软官方表示，受该漏洞影响的用户需启用Exchange Server的Windows扩展保护以防护该漏洞。CVSS评分为7.6。目前该漏洞已被公开披露。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30134


Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞（CVE-2022-35767/CVE-2022-35766/CVE-2022-35752）：

Windows 安全套接字隧道协议 (SSTP) 存在远程代码执行漏洞。由于Windows安全套接字隧道协议 (SSTP) 的安全限制存在缺陷，在特定的配置环境中，无需身份验证的远程攻击者通过向RAS服务器发送特制的请求，最终导致在目标服务器上任意执行代码，且无需用户交互。CVSS评分为8.1。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35767

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35766

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35752


Active Directory Domain Services权限提升漏洞（CVE-2022-34691）：

活动目录（Active Directory）是面向 Windows Standard Server、Windows Enterprie Server 以及 Windows Datacenter Server 的目录服务。由于Active Directory域服务的安全限制存在缺陷，当 Active Directory证书服务在域上运行时，经过身份验证的远程攻击者可利用该漏洞在目标系统上提升至管理员权限并执行任意代码。CVSS评分为8.8。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34691


Windows点对点协议(PPP)远程代码执行漏洞（CVE-2022-35744）：

点对点协议（Point-to-Point Protocol）简称PPP协议，工作在数据链路层。设计目的主要是用来通过拨号或专线方式建立点对点连接发送数据，使其成为各种主机、网桥和路由器之间简单连接的一种共通的解决方案。由于Windows点对点协议的安全限制存在缺陷，无需身份验证的远程攻击者通过向RAS服务器发送特制的请求，最终导致在目标服务器上任意执行代码，且无需用户交互。CVSS评分为9.8。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35744


Azure Batch Node Agent权限提升漏洞（CVE-2022-33646）：

Azure Batch Node Agent中存在权限提升漏洞。由于Azure Batch Node Agent中的应用程序未实行正确的安全限制，在特定的配置环境下，具有低权限的本地攻击者通过利用该漏洞绕过安全限制，从而在目标系统上提升至SYSTEM权限并执行任意代码。CVSS评分为7.0。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33646


Windows Hyper-V 远程代码执行漏洞（CVE-2022-34696）：

Windows Hyper-V是Microsoft的本地虚拟机管理程序，具有低权限的远程攻击者可通过在Hyper-V guest上运行特制的应用程序，最终导致在Hyper-V主机系统执行任意代码，且无需用户交互。CVSS评分为8.5。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34696


Windows Print Spooler权限提升漏洞（CVE-2022-35755/CVE-2022-35793）：

Windows Print Spooler存在权限提升漏洞。由于在Windows Print Spooler未实行正确的安全限制，具有低权限的本地攻击者通过利用该漏洞绕过安全限制，从而在目标系统上提升至SYSTEM权限并执行任意代码。CVSS评分为7.3。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35755

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35793


Windows Kernel权限提升漏洞（CVE-2022-35761）：

Windows Kernel存在权限提升漏洞，无需身份验证的本地攻击者成功利用该漏洞，最终可实现在目标系统上提升至SYSTEM权限并执行任意代码。CVSS评分为8.4。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35761


SMB客户端与服务端远程代码执行漏洞（CVE-2022-35804）： 

SMB协议中存在远程代码执行漏洞。由于SMB协议中未实行正确的安全限制，无需身份验证的远程攻击者成功利用该漏洞，最终可实现任意代码执行。该漏洞可通过客户端与服务端两种载体进行利用。CVSS评分为8.8。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35804


3影响范围

以下为重点关注漏洞的受影响产品版本，其他漏洞影响产品范围请参阅官方通告链接。

漏洞编号

受影响产品版本

CVE-2022-34713


Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems

Windows 7 for x64-based Systems Service Pack 1

Windows 7 for 32-bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

CVE-2022-30134

Microsoft Exchange Server 2019 Cumulative Update 11

Microsoft Exchange Server 2016 Cumulative Update 22

Microsoft Exchange Server 2013 Cumulative Update 23

Microsoft Exchange Server 2016 Cumulative Update 23

Microsoft Exchange Server 2019 Cumulative Update 12

CVE-2022-35767

CVE-2022-35752

CVE-2022-35793

CVE-2022-34691

CVE-2022-35744


Windows 10 Version 1809 for 32-bit Systems

Windows 10 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows 7 for x64-based Systems Service Pack 1

Windows 7 for 32-bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

CVE-2022-35766


Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

CVE-2022-33646

Azure Batch

CVE-2022-34696

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows 8.1 for x64-based systems

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 for x64-based Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for x64-based Systems

CVE-2022-35755


Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

CVE-2022-35761

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

CVE-2022-35804

Windows 11 for x64-based Systems

Windows 11 for ARM64-based Systems


4漏洞防护

4.1 补丁更新

目前微软官方已针对受支持的产品版本发布了修复以上漏洞的安全补丁，强烈建议受影响用户尽快安装补丁进行防护，官方下载链接：

https://msrc.microsoft.com/update-guide/en-us/releaseNote/2022-Aug

注：由于网络问题、计算机环境问题等原因，Windows Update的补丁更新可能出现失败。用户在安装补丁后，应及时检查补丁是否成功更新。

右键点击Windows图标，选择“设置(N)”，选择“更新和安全”-“Windows更新”，查看该页面上的提示信息，也可点击“查看更新历史记录”查看历史更新情况。

针对未成功安装的更新，可点击更新名称跳转到微软官方下载页面，建议用户点击该页面上的链接，转到“Microsoft更新目录”网站下载独立程序包并安装。

附录：漏洞列表

影响产品

CVE编号

漏洞标题

严重程度

Active Directory Domain Services

CVE-2022-34691

Active Directory 域服务特权提升漏洞

Critical

Azure Batch Node Agent

CVE-2022-33646

Azure Batch 节点代理特权提升漏洞

Critical

Microsoft Exchange Server

CVE-2022-21980

Microsoft Exchange Server 特权提升漏洞

Critical

Microsoft Exchange Server

CVE-2022-24516

Microsoft Exchange Server 特权提升漏洞

Critical

Microsoft Exchange Server

CVE-2022-24477

Microsoft Exchange Server 特权提升漏洞

Critical

Remote Access Service Point-to-Point Tunneling Protocol

CVE-2022-35752

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

Remote Access Service Point-to-Point Tunneling Protocol

CVE-2022-35753

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

Role: Windows Hyper-V

CVE-2022-34696

Windows Hyper-V 远程执行代码漏洞

Critical

Windows Kernel

CVE-2022-35804

SMB 客户端和服务器远程代码执行漏洞

Critical

Windows Point-to-Point Tunneling Protocol

CVE-2022-30133

Windows 点对点协议 (PPP) 远程代码执行漏洞

Critical

Windows Point-to-Point Tunneling Protocol

CVE-2022-35744

Windows 点对点协议 (PPP) 远程代码执行漏洞

Critical

Windows Secure Socket Tunneling Protocol (SSTP)

CVE-2022-35745

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

Windows Secure Socket Tunneling Protocol (SSTP)

CVE-2022-35766

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

Windows Secure Socket Tunneling Protocol (SSTP)

CVE-2022-35794

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

Windows Secure Socket Tunneling Protocol (SSTP)

CVE-2022-34714

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

Windows Secure Socket Tunneling Protocol (SSTP)

CVE-2022-34702

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

Windows Secure Socket Tunneling Protocol (SSTP)

CVE-2022-35767

Windows 安全套接字隧道协议 (SSTP) 远程代码执行漏洞

Critical

.NET Core

CVE-2022-34716

.NET 欺骗漏洞

Important

Azure Real Time Operating System

CVE-2022-34685

Azure RTOS GUIX Studio 信息泄露漏洞

Important

Azure Real Time Operating System

CVE-2022-34686

Azure RTOS GUIX Studio 信息泄露漏洞

Important

Azure Real Time Operating System

CVE-2022-35773

Azure RTOS GUIX Studio 远程代码执行漏洞

Important

Azure Real Time Operating System

CVE-2022-35779

Azure RTOS GUIX Studio 远程代码执行漏洞

Important

Azure Real Time Operating System

CVE-2022-35806

Azure RTOS GUIX Studio 远程代码执行漏洞

Important

Azure Real Time Operating System

CVE-2022-34687

Azure RTOS GUIX Studio 远程代码执行漏洞

Important

Azure Real Time Operating System

CVE-2022-30176

Azure RTOS GUIX Studio 远程代码执行漏洞

Important

Azure Real Time Operating System

CVE-2022-30175

Azure RTOS GUIX Studio 远程代码执行漏洞

Important

Azure Site Recovery

CVE-2022-35791

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35818

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35809

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35789

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35815

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35817

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35816

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35814

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35785

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35812

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35811

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35784

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35810

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35813

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35788

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35783

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35786

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35787

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35819

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35781

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35775

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35790

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35780

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35799

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35772

Azure Site Recovery 远程代码执行漏洞

Important

Azure Site Recovery

CVE-2022-35800

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35774

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35802

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35782

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35824

Azure Site Recovery 远程代码执行漏洞

Important

Azure Site Recovery

CVE-2022-35801

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35808

Azure Site Recovery 特权提升漏洞

Important

Azure Site Recovery

CVE-2022-35776

Azure Site Recovery 拒绝服务漏洞

Important

Azure Site Recovery

CVE-2022-35807

Azure Site Recovery 特权提升漏洞

Important

Azure Sphere

CVE-2022-35821

Azure Sphere 信息泄露漏洞

Important

Microsoft ATA Port Driver

CVE-2022-35760

Microsoft ATA 端口驱动程序特权提升漏洞

Important

Microsoft Bluetooth Driver

CVE-2022-35820

Windows 蓝牙驱动程序特权提升漏洞

Important

Microsoft Edge (Chromium-based)

CVE-2022-33649

Microsoft Edge（基于 Chromium）安全功能绕过漏洞

Important

Microsoft Exchange Server

CVE-2022-34692

Microsoft Exchange 信息泄露漏洞

Important

Microsoft Exchange Server

CVE-2022-21979

Microsoft Exchange 信息泄露漏洞

Important

Microsoft Exchange Server

CVE-2022-30134

Microsoft Exchange 信息泄露漏洞

Important

Microsoft Office

CVE-2022-34717

Microsoft Office 远程代码执行漏洞

Important

Microsoft Office Excel

CVE-2022-33648

Microsoft Excel 远程代码执行漏洞

Important

Microsoft Office Excel

CVE-2022-33631

Microsoft Excel 安全功能绕过漏洞

Important

Microsoft Office Outlook

CVE-2022-35742

Microsoft Outlook 拒绝服务漏洞

Important

Microsoft Windows Support Diagnostic Tool (MSDT)

CVE-2022-34713

Microsoft Windows 支持诊断工具 (MSDT) 远程代码执行漏洞

Important

Microsoft Windows Support Diagnostic Tool (MSDT)

CVE-2022-35743

Microsoft Windows 支持诊断工具 (MSDT) 远程代码执行漏洞

Important

Remote Access Service Point-to-Point Tunneling Protocol

CVE-2022-35769

Windows 点对点协议 (PPP) 拒绝服务漏洞

Important

Role: Windows Fax Service

CVE-2022-34690

Windows 传真服务特权提升漏洞

Important

Role: Windows Hyper-V

CVE-2022-35751

Windows Hyper-V 特权提升漏洞

Important

System Center Operations Manager

CVE-2022-33640

System Center Operations Manager：开放式管理基础架构 (OMI) 特权提升漏洞

Important

Visual Studio

CVE-2022-35827

Visual Studio 远程代码执行漏洞

Important

Visual Studio

CVE-2022-35777

Visual Studio 远程代码执行漏洞

Important

Visual Studio

CVE-2022-35825

Visual Studio 远程代码执行漏洞

Important

Visual Studio

CVE-2022-35826

Visual Studio 远程代码执行漏洞

Important

Windows Bluetooth Service

CVE-2022-30144

Windows蓝牙服务远程代码执行漏洞

Important

Windows Canonical Display Driver

CVE-2022-35750

Win32k 特权提升漏洞

Important

Windows Cloud Files Mini Filter Driver

CVE-2022-35757

Windows Cloud Files Mini Filter 驱动程序提权漏洞

Important

Windows Defender Credential Guard

CVE-2022-35771

Windows Defender Credential Guard 特权提升漏洞

Important

Windows Defender Credential Guard

CVE-2022-34705

Windows Defender Credential Guard 特权提升漏洞

Important

Windows Defender Credential Guard

CVE-2022-34710

Windows Defender Credential Guard 信息泄露漏洞

Important

Windows Defender Credential Guard

CVE-2022-34709

Windows Defender Credential Guard 安全功能绕过漏洞

Important

Windows Defender Credential Guard

CVE-2022-34704

Windows Defender Credential Guard 信息泄露漏洞

Important

Windows Defender Credential Guard

CVE-2022-34712

Windows Defender Credential Guard 信息泄露漏洞

Important

Windows Digital Media

CVE-2022-35746

Windows 数字媒体接收器特权提升漏洞

Important

Windows Digital Media

CVE-2022-35749

Windows 数字媒体接收器特权提升漏洞

Important

Windows Error Reporting

CVE-2022-35795

Windows 错误报告服务特权提升漏洞

Important

Windows Hello

CVE-2022-35797

Windows Hello 安全功能绕过漏洞

Important

Windows Internet Information Services

CVE-2022-35748

HTTP.sys 拒绝服务漏洞

Important

Windows Kerberos

CVE-2022-35756

Windows Kerberos 特权提升漏洞

Important

Windows Kernel

CVE-2022-35761

Windows 内核特权提升漏洞

Important

Windows Kernel

CVE-2022-35768

Windows 内核特权提升漏洞

Important

Windows Kernel

CVE-2022-34708

Windows 内核信息泄露漏洞

Important

Windows Kernel

CVE-2022-34707

Windows 内核特权提升漏洞

Important

Windows Kernel

CVE-2022-30197

Windows 内核信息泄露漏洞

Important

Windows Kernel

CVE-2022-35758

Windows 内核内存信息泄露漏洞

Important

Windows Local Security Authority (LSA)

CVE-2022-34706

Windows 本地安全机构 (LSA) 特权提升漏洞

Important

Windows Local Security Authority (LSA)

CVE-2022-35759

Windows 本地安全机构 (LSA) 拒绝服务漏洞

Important

Windows Network File System

CVE-2022-34715

Windows 网络文件系统远程代码执行漏洞

Important

Windows Partition Management Driver

CVE-2022-33670

Windows 分区管理驱动程序特权提升漏洞

Important

Windows Partition Management Driver

CVE-2022-34703

Windows 分区管理驱动程序特权提升漏洞

Important

Windows Point-to-Point Tunneling Protocol

CVE-2022-35747

Windows 点对点协议 (PPP) 拒绝服务漏洞

Important

Windows Print Spooler Components

CVE-2022-35793

Windows 后台打印程序特权提升漏洞

Important

Windows Print Spooler Components

CVE-2022-35755

Windows 后台打印程序特权提升漏洞

Important

Windows Secure Boot

CVE-2022-34301

CERT/CC：CVE-2022-34301 Eurosoft 引导加载程序绕过

Important

Windows Secure Boot

CVE-2022-34302

CERT/CC：CVE-2022-34302 New Horizon Data Systems Inc 引导加载程序绕过

Important

Windows Secure Boot

CVE-2022-34303

CERT/CC：CVE-20220-34303 Crypto Pro 引导加载程序绕过

Important

Windows Secure Socket Tunneling Protocol (SSTP)

CVE-2022-34701

Windows 安全套接字隧道协议 (SSTP) 拒绝服务漏洞

Important

Windows Storage Spaces Direct

CVE-2022-35762

存储空间直接提升特权漏洞

Important

Windows Storage Spaces Direct

CVE-2022-35765

存储空间直接提升特权漏洞

Important

Windows Storage Spaces Direct

CVE-2022-35792

存储空间直接提升特权漏洞

Important

Windows Storage Spaces Direct

CVE-2022-35763

存储空间直接提升特权漏洞

Important

Windows Storage Spaces Direct

CVE-2022-35764

存储空间直接提升特权漏洞

Important

Windows Unified Write Filter

CVE-2022-35754

统一写入过滤器特权提升漏洞

Important

Windows WebBrowser Control

CVE-2022-30194

Windows WebBrowser 控制远程代码执行漏洞

Important

Windows Win32K

CVE-2022-34699

Windows Win32k 特权提升漏洞

Important


END

         
        
声明

本安全公告仅用来描述可能存在的安全问题，绿盟科技不为此安全公告提供任何保证或承诺。由于传播、利用此安全公告所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，绿盟科技以及安全公告作者不为此承担任何责任。            

绿盟科技拥有对此安全公告的修改和解释权。如欲转载或传播此安全公告，必须保证此安全公告的完整性，包括版权声明等全部内容。未经绿盟科技允许，不得任意修改或者增减此安全公告内容，不得以任何方式将其用于商业目的。            

绿盟科技CERT ∣微信公众号
长按识别二维码，关注网络安全威胁信息





【安全更新】微软8月安全更新多个产品高危漏洞通告


推荐站内搜索：最好用的开发软件、免费开源系统、渗透测试工具云盘下载、最新渗透测试资料、最新黑客工具下载……
周飒博客-ZhouSa.com