微軟4月補丁日多個高危安全漏洞 - 網安 - 專業的網絡安全產業、社區、知識平臺

微軟4月補丁日多個高危安全漏洞

4月13日，微軟官方發布了本月的安全更新通告，對多個產品中的安全漏洞進行了修復：

https://msrc.microsoft.com/update-guide/releaseNote/2022-Apr

其中值得重點關注的可遠程利用的服務端漏洞主要包括CVE-2022-26809 Remote Procedure Call Runtime 遠程代碼執行漏洞，CVE-2022-24491、CVE-2022-24497 Windows Network File System 遠程代碼執行漏洞。

漏洞描述

CVE-2022-26809 Remote Procedure Call Runtime 遠程代碼執行漏洞

Remote Procedure Call Runtime 存在遠程代碼執行漏洞，攻擊者可通過構造惡意的 RPC 請求來利用此漏洞。此漏洞的利用無需用戶交互，也無需授權，可通過 445 端口被攻擊者遠程利用，因此被認為是可蠕蟲的漏洞。目前此漏洞尚未有公開的細節和利用腳本。

CVE-2022-24491、CVE-2022-24497 Windows Network File System 遠程代碼執行漏洞

CVE-2022-24491 和 CVE-2022-24497 都是存在于 Windows Network File System 中的遠程代碼執行漏洞，遠程且未經過授權的攻擊者可通過發送惡意的 NFS 協議數據包來進行漏洞利用。這兩個漏洞只影響啟用了 NFS 角色的 Windows 系統，且目前尚未有公開的細節和利用腳本。

影響范圍

CVE

影響系統范圍

CVE-2022-26809 Remote Procedure Call Runtime 遠程代碼執行漏洞

Windows 7 for 32-bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows 11 for ARM64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 1909 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 10 Version 1809 for 32-bit Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 Version 1909 for x64-based Systems

Windows 10 Version 1909 for 32-bit Systems

Windows 10 Version 1809 for ARM64-based Systems

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows 8.1 for 32-bit systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 11 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019