【安全更新】微软4月安全更新多个产品高危漏洞通告

一、漏洞概述

4月14日,微软发布4月安全更新补丁,修复了114个安全漏洞,涉及Windows、Office、Edge (Chromium-based) 、Visual Studio Code、Exchange Server、Visual Studio、Azure等广泛使用的产品,其中包括远程代码执行和权限提升等高危漏洞类型。

本月微软月度更新修复的漏洞中,严重程度为关键(Critical)的漏洞有19个,重要(Important)漏洞有88个。请相关用户尽快更新补丁进行防护。详细漏洞列表请参考附录。

参考链接:https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Apr

二、重点漏洞简述

根据产品流行度和漏洞重要性筛选出此次更新中包含影响较大的漏洞,请相关用户重点进行关注:

  • Exchange Server代码执行漏洞(CVE-2021-28480/CVE-2021-28481/CVE-2021-28482/CVE-2021-28483):

 攻击者可利用上述漏洞绕过Exchange身份验证,无需用户交互即可实现命令执行。 CVE-2021-28480和CVE-2021-28481的CVSS评分为9.8分,是未授权远程代码执行漏洞,未经身份验证的攻击者利用漏洞,可在内网的Exchange服务器进行横向扩散,可能造成蠕虫级漏洞的危害。

官方通告链接:

https://msrc.microsoft.com/update-guide/en-US/security-guidance/advisory/CVE-2021-28480

https://msrc.microsoft.com/update-guide/en-US/security-guidance/advisory/CVE-2021-28481

https://msrc.microsoft.com/update-guide/en-US/security-guidance/advisory/CVE-2021-28482

https://msrc.microsoft.com/update-guide/en-US/security-guidance/advisory/CVE-2021-28483

  • Win32k 权限提升漏洞(CVE-2021-28310):

Win32k存在权限提升漏洞,攻击者利用此漏洞可在目标主机上以SYSTEM权限执行任意代码。目前漏洞细节已公开,且已检测到在野攻击。

官方通告链接:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28310

  • Windows Hyper-V 安全功能绕过漏洞(CVE-2021-28444):

攻击者可以绕过使用Router Guard配置的Hyper-V,将Windows配置为中间人路由器,从而实现截获流量并修改数据包。

官方通告链接:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28444

  • Windows SMB信息泄露漏洞(CVE-2021-28324/CVE-2021-28325):

 Windows SMB存在两个信息泄露漏洞(CVE-2021-28324、CVE-2021-28325),攻击者可以访问内核空间中的内存内容。CVE-2021-28324无需身份验证,攻击者利用此漏洞可以未授权获取目标系统敏感信息。

官方通告链接:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28324

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28325

三、影响范围

以下为重点关注漏洞的受影响产品版本,其他漏洞影响产品范围请参阅官方通告链接。

漏洞编号受影响产品版本
CVE-2021-28480
CVE-2021-28481
CVE-2021-28482
CVE-2021-28483
Microsoft Exchange Server 2019 Cumulative Update 8
Microsoft Exchange Server 2019 Cumulative Update 9
Microsoft Exchange Server 2016 Cumulative Update 19
Microsoft Exchange Server 2016 Cumulative Update 20
Microsoft Exchange Server 2013 Cumulative Update 23
CVE-2021-28310Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows Server, version 1909 (Server Core installation)
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019  (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
CVE-2021-28444Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows 8.1 for x64-based systems
Windows Server 2016  (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for x64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 2004 for x64-based Systems
Windows Server, version 1909 (Server Core installation)
Windows 10 Version 1909 for x64-based Systems
Windows Server 2019  (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1803 for x64-based Systems
CVE-2021-28324Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
CVE-2021-28325Windows 10 Version 2004 for 32-bit Systems
Windows Server, version 1909 (Server Core installation)
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019  (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 for 32-bit Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows Server 2016  (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems

四、漏洞防护

  • 补丁更新

目前微软官方已针对受支持的产品版本发布了修复以上漏洞的安全补丁,强烈建议受影响用户尽快安装补丁进行防护,官方下载链接:

https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Apr

注:由于网络问题、计算机环境问题等原因,Windows Update的补丁更新可能出现失败。用户在安装补丁后,应及时检查补丁是否成功更新。

右键点击Windows图标,选择“设置(N)”,选择“更新和安全”-“Windows更新”,查看该页面上的提示信息,也可点击“查看更新历史记录”查看历史更新情况。

针对未成功安装的更新,可点击更新名称跳转到微软官方下载页面,建议用户点击该页面上的链接,转到“Microsoft更新目录”网站下载独立程序包并安装。

附录:漏洞列表

影响产品CVE 编号漏洞标题严重程度
WindowsCVE-2021-27095Windows Media Video Decoder 远程代码执行漏洞Critical
WindowsCVE-2021-28315Windows Media Video Decoder 远程代码执行漏洞Critical
WindowsCVE-2021-28329Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28330Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28331Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28332Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28333Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28334Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28335Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28336Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28337Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28338Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28339Remote Procedure Call Runtime 远程代码执行漏洞Critical
WindowsCVE-2021-28343Remote Procedure Call Runtime 远程代码执行漏洞Critical
AzureCVE-2021-28460Azure Sphere Unsigned Code Execution VulnerabilityCritical
Exchange ServerCVE-2021-28480Microsoft Exchange Server 远程代码执行漏洞Critical
Exchange ServerCVE-2021-28481Microsoft Exchange Server 远程代码执行漏洞Critical
Exchange ServerCVE-2021-28482Microsoft Exchange Server 远程代码执行漏洞Critical
Exchange ServerCVE-2021-28483Microsoft Exchange Server 远程代码执行漏洞Critical
Team Foundation Server,Azure DevOps ServerCVE-2021-27067Azure DevOps Server and Team Foundation Server 信息披露漏洞Important
WindowsCVE-2021-27072Win32k 权限提升漏洞Important
WindowsCVE-2021-27079Windows Media Photo Codec 信息披露漏洞Important
WindowsCVE-2021-27088Windows Event Tracing 权限提升漏洞Important
WindowsCVE-2021-27089Microsoft Internet Messaging API 远程代码执行漏洞Important
WindowsCVE-2021-27090Windows Secure Kernel Mode 权限提升漏洞Important
WindowsCVE-2021-27091RPC Endpoint Mapper Service 权限提升漏洞Important
WindowsCVE-2021-27092Azure AD Web Sign-in 安全功能绕过漏洞Important
WindowsCVE-2021-27093Windows Kernel 信息披露漏洞Important
WindowsCVE-2021-27094Windows Early Launch Antimalware Driver 安全功能绕过漏洞Important
WindowsCVE-2021-27096NTFS 权限提升漏洞Important
WindowsCVE-2021-26413Windows Installer 欺骗漏洞Important
WindowsCVE-2021-26415Windows Installer 权限提升漏洞Important
WindowsCVE-2021-26416Windows Hyper-V 拒绝服务漏洞Important
WindowsCVE-2021-26417Windows Overlay Filter 信息披露漏洞Important
WindowsCVE-2021-28309Windows Kernel 信息披露漏洞Important
WindowsCVE-2021-28310Win32k 权限提升漏洞Important
WindowsCVE-2021-28311Windows Application Compatibility Cache 拒绝服务漏洞Important
Microsoft Visual Studio,WindowsCVE-2021-28313Diagnostics Hub Standard Collector Service 权限提升漏洞Important
WindowsCVE-2021-28314Windows Hyper-V 权限提升漏洞Important
WindowsCVE-2021-28316Windows WLAN AutoConfig Service 安全功能绕过漏洞Important
WindowsCVE-2021-28317Microsoft Windows Codecs Library 信息披露漏洞Important
WindowsCVE-2021-28318Windows GDI+ 信息披露漏洞Important
WindowsCVE-2021-28319Windows TCP/IP Driver 拒绝服务漏洞Important
WindowsCVE-2021-28320Windows Resource Manager PSM Service Extension 权限提升漏洞Important
Microsoft Visual Studio,WindowsCVE-2021-28321Diagnostics Hub Standard Collector Service 权限提升漏洞Important
Microsoft Visual Studio,WindowsCVE-2021-28322Diagnostics Hub Standard Collector Service 权限提升漏洞Important
WindowsCVE-2021-28323Windows DNS 信息披露漏洞Important
WindowsCVE-2021-28324Windows SMB 信息披露漏洞Important
WindowsCVE-2021-28325Windows SMB 信息披露漏洞Important
WindowsCVE-2021-28326Windows AppX Deployment Server 拒绝服务漏洞Important
WindowsCVE-2021-28327Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28328Windows DNS 信息披露漏洞Important
WindowsCVE-2021-28340Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28341Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28342Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28344Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28345Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28346Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28347Windows Speech Runtime 权限提升漏洞Important
WindowsCVE-2021-28348Windows GDI+ 远程代码执行漏洞Important
WindowsCVE-2021-28349Windows GDI+ 远程代码执行漏洞Important
WindowsCVE-2021-28350Windows GDI+ 远程代码执行漏洞Important
WindowsCVE-2021-28351Windows Speech Runtime 权限提升漏洞Important
WindowsCVE-2021-28352Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28353Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28354Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28355Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28356Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28357Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28358Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28434Remote Procedure Call Runtime 远程代码执行漏洞Important
WindowsCVE-2021-28435Windows Event Tracing 信息披露漏洞Important
WindowsCVE-2021-28436Windows Speech Runtime 权限提升漏洞Important
WindowsCVE-2021-28437Windows Installer 信息披露漏洞Important
WindowsCVE-2021-28438Windows Console Driver 拒绝服务漏洞Important
WindowsCVE-2021-28439Windows TCP/IP Driver 拒绝服务漏洞Important
WindowsCVE-2021-28440Windows Installer 权限提升漏洞Important
WindowsCVE-2021-28441Windows Hyper-V 信息披露漏洞Important
WindowsCVE-2021-28442Windows TCP/IP 信息披露漏洞Important
WindowsCVE-2021-28443Windows Console Driver 拒绝服务漏洞Important
WindowsCVE-2021-28444Windows Hyper-V 安全功能绕过漏洞Important
WindowsCVE-2021-28445Windows Network File System 远程代码执行漏洞Important
WindowsCVE-2021-28446Windows Portmapping 信息披露漏洞Important
WindowsCVE-2021-28447Windows Early Launch Antimalware Driver 安全功能绕过漏洞Important
Visual Studio Code – Kubernetes ToolsCVE-2021-28448Visual Studio Code Kubernetes Tools 远程代码执行漏洞Important
Microsoft OfficeCVE-2021-28449Microsoft Office 远程代码执行漏洞Important
Microsoft OfficeCVE-2021-28450Microsoft SharePoint Denial of Service UpdateImportant
Microsoft OfficeCVE-2021-28451Microsoft Excel 远程代码执行漏洞Important
Microsoft OfficeCVE-2021-28452Microsoft Outlook 内存泄露漏洞Important
Microsoft OfficeCVE-2021-28453Microsoft Word 远程代码执行漏洞Important
Microsoft OfficeCVE-2021-28454Microsoft Excel 远程代码执行漏洞Important
Microsoft OfficeCVE-2021-28456Microsoft Excel 信息披露漏洞Important
Visual Studio CodeCVE-2021-28457Visual Studio Code 远程代码执行漏洞Important
AzureCVE-2021-28458Azure ms-rest-nodeauth Library 权限提升漏洞Important
Azure DevOps ServerCVE-2021-28459Azure DevOps Server 欺骗漏洞Important
Visual Studio CodeCVE-2021-28469Visual Studio Code 远程代码执行漏洞Important
Visual Studio Code – GitHub Pull Requests and Issues ExtensionCVE-2021-28470Visual Studio Code GitHub Pull Requests and Issues Extension 远程代码执行漏洞Important
Visual Studio CodeCVE-2021-28471Remote Development Extension for Visual Studio Code 远程代码执行漏洞Important
Visual Studio Code – Maven for Java ExtensionCVE-2021-28472Visual Studio Code Maven for Java Extension 远程代码执行漏洞Important
Visual Studio CodeCVE-2021-28475Visual Studio Code 远程代码执行漏洞Important
Visual Studio CodeCVE-2021-28477Visual Studio Code 远程代码执行漏洞Important
Microsoft Visual StudioCVE-2021-27064Visual Studio Installer 权限提升漏洞Important
WindowsCVE-2021-27086Windows Services and Controller App 权限提升漏洞Important
WindowsCVE-2021-28464VP9 Video Extensions 远程代码执行漏洞Important
WindowsCVE-2021-28466Raw Image Extension 远程代码执行漏洞Important
WindowsCVE-2021-28468Raw Image Extension 远程代码执行漏洞Important
Visual Studio CodeCVE-2021-28473Visual Studio Code 远程代码执行漏洞Important
WindowsCVE-2021-28312Windows NTFS 拒绝服务漏洞Moderate
Microsoft Edge (Chromium-based)CVE-2021-21194Chromium: CVE-2021-21194 Use after free in screen captureUnknown
Microsoft Edge (Chromium-based)CVE-2021-21195Chromium: CVE-2021-21195 Use after free in V8Unknown
Microsoft Edge (Chromium-based)CVE-2021-21196Chromium: CVE-2021-21196 Heap buffer overflow in TabStripUnknown
Microsoft Edge (Chromium-based)CVE-2021-21197Chromium: CVE-2021-21197 Heap buffer overflow in TabStripUnknown
Microsoft Edge (Chromium-based)CVE-2021-21198Chromium: CVE-2021-21198 Out of bounds read in IPCUnknown
Microsoft Edge (Chromium-based)CVE-2021-21199Chromium: CVE-2021-21199 Use Use after free in AuraUnknown

声明

本安全公告仅用来描述可能存在的安全问题,绿盟科技不为此安全公告提供任何保证或承诺。由于传播、利用此安全公告所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,绿盟科技以及安全公告作者不为此承担任何责任。

绿盟科技拥有对此安全公告的修改和解释权。如欲转载或传播此安全公告,必须保证此安全公告的完整性,包括版权声明等全部内容。未经绿盟科技允许,不得任意修改或者增减此安全公告内容,不得以任何方式将其用于商业目的。

Spread the word. Share this post!

Meet The Author

Leave Comment