【漏洞通告】微软补丁日安全通告|11月份
【漏洞通告】微软补丁日安全通告|11月份
深益研究实验室 深信服千里目安全技术中心 2022-11-09 15:38
2022年11月9日（北京时间），微软发布了安全更新，共发布了69个CVE的补丁程序，同比上月减少了14个。
在漏洞安全等级方面，存在12个标记等级为 “Critical” 的漏洞，57个漏洞被标记为 “Important/High” ；在漏洞类型方面，主要有18个远程代码执行漏洞，27个权限提升漏洞以及10个信息泄露漏洞。
漏洞分析
2022年漏洞数量趋势
图 1 2022年微软补丁漏洞修复情况
-
总体上来看，微软本月发布的补丁数量为69个，有12个 Critical 漏洞补丁。
-
千里目安全技术中心在综合考虑往年微软公布漏洞数量的数据统计和今年的特殊情况，初步估计微软在今年十二月份公布的漏洞数将比十一月略多。漏洞数量将会维持在100个左右。
历史微软补丁日11月漏洞对比
2019-2022年，11月份的漏洞数趋势如下图：
图 2 微软近年11月漏洞数量对比
2019-2022年，11月份的漏洞危险等级趋势和数量如下图：
图 3 微软近年11月漏洞危险等级对比
2019-2022年，11月份的漏洞各个类型数量对比如下图：
图 4 微软近年11月漏洞类型对比
从漏洞数量来看，今年相较去年少量增加。
微软在2022 年 11 月份爆发的漏洞相较于去年有少量的增加。本月出现了69个漏洞补丁，并且有12个 Critical 类型的漏洞补丁。
从漏洞的危险等级来看，相较去年 “Important” 等级的漏洞有少量增加， “Critical” 等级的漏洞有大量增加，近两年相对历史数据而言总体漏洞数量变化较小。
从漏洞趋势上看，针对 Windows 系统本身的严重型和高危型漏洞数量增加，针对 Windows 产品侧的漏洞数量占据大多数。
从漏洞类型来看，RCE 类型的漏洞数量变化较小，DoS类型的漏洞有大幅度的提升，EoP 类型的漏洞数量变化较小，
仍然需要引起高度重视，尤其是 RCE 漏洞在配合社工手段的前提下，甚至可以直接接管整个局域网并进行进一步扩展攻击。
重要漏洞分析
漏洞分析
Windows Web 查询标记安全功能绕过漏洞 CVE-2022-41091
Windows Web查询标记是被设计用来从未信任来源的文件保护用户的Windows特性。标记是Windows放在从互联网上下载的文件上的隐藏标签。
其中存在安全功能绕过漏洞，攻击者可以利用该漏洞在绕过目标系统上的安全功能，做出规定之外的行为。漏洞存在在野利用，该漏洞经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Microsoft Exchange Server 特权提升漏洞 CVE-2022-41040
Microsoft Exchange Server是微软公司开发与销售的一套群组软件。除传统的电子邮件的存取、储存、转发作用外，在新版本的产品中亦加入了一系列辅助功能，如语音邮件、邮件过滤筛选和Outlook Web Access。Exchange Server支持多种电子邮件网络协议，如SMTP、NNTP、POP3和IMAP4。
其中存在特权提升漏洞，攻击者可以利用该漏洞在目标系统上获取更高的权限。漏洞存在在野利用，该漏洞经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Microsoft Exchange Server 远程执行代码漏洞 CVE-2022-41082
Microsoft Exchange Server是微软公司开发与销售的一套群组软件。除传统的电子邮件的存取、储存、转发作用外，在新版本的产品中亦加入了一系列辅助功能，如语音邮件、邮件过滤筛选和Outlook Web Access。Exchange Server支持多种电子邮件网络协议，如SMTP、NNTP、POP3和IMAP4。
其中存在远程命令执行漏洞，
攻击者可以利用该漏洞在目标系统执行任意代码。漏洞存在在野利用，该漏洞经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Windows 脚本语言远程代码执行漏洞 CVE-2022-41128
JScript是由微软公司开发的动态脚本语言，是微软对ECMAScript规范的实现。
其中存在远程命令执行漏洞，
攻击者可以利用该漏洞在目标系统执行任意代码。漏洞存在在野利用，该漏洞经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Windows CNG 密钥隔离服务特权提升漏洞 CVE-2022-41125
CNG是Windows加密API的更新。它允许相同的函数使用更多的加密算法工作。它还具有灵活性，支持将自定义加密API插入CNG运行时。
其中存在特权提升漏洞，
攻击者可以利用该漏洞在目标系统上获取更高的权限。漏洞存在在野利用，该漏洞经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Windows 打印后台处理程序特权提升漏洞 CVE-2022-41073
打印后台处理程序服务是在参与打印服务系统的每台计算机上运行的服务。打印后台处理程序服务通过允许每个参与系统充当打印服务系统的打印客户机、管理客户机或打印服务器，实现了打印客户机和打印服务器角色。
其中存在特权提升漏洞，攻击者可以利用该漏洞在目标系统上获取更高的权限。漏洞存在在野利用，该漏洞经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
影响范围
|
漏洞名称、CVE编号 |
受影响版本 |
|
Windows Web 查询标记安全功能绕过漏洞 CVE-2022-41091 |
Windows 10 Version 22H2 for x64-based Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 for ARM64-based Systems Windows 11 for x64-based Systems Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Datacenter: Azure Edition (Hotpatch) Windows Server 2022 (Server Core installation) Windows Server 2022 Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
|
Microsoft Exchange Server 特权提升漏洞 CVE-2022-41040 |
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2016 Cumulative Update 22 Microsoft Exchange Server 2013 Cumulative Update 23 |
|
Microsoft Exchange Server 远程执行代码漏洞 CVE-2022-41082 |
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2016 Cumulative Update 22 Microsoft Exchange Server 2013 Cumulative Update 23 |
|
Windows 脚本语言远程代码执行漏洞 CVE-2022-41128 |
Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 7 for x64-based Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows Server 2012 R2 Windows Server 2012 Windows Server 2012 Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows RT 8.1 Windows 8.1 for x64-based systems Windows 8.1 for x64-based systems Windows 8.1 for x64-based systems Windows 8.1 for 32-bit systems Windows 8.1 for 32-bit systems Windows 8.1 for 32-bit systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 for ARM64-based Systems Windows 11 for x64-based Systems Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
|
Windows CNG 密钥隔离服务特权提升漏洞 CVE-2022-41125 |
Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2012 Windows RT 8.1 Windows 8.1 for x64-based systems Windows 8.1 for x64-based systems Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 (Server Core installation) Windows 8.1 for 32-bit systems Windows 8.1 for 32-bit systems Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 for ARM64-based Systems Windows 11 for x64-based Systems Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Datacenter: Azure Edition (Hotpatch) Windows Server 2022 (Server Core installation) Windows Server 2022 Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems |
|
Windows 打印后台处理程序特权提升漏洞 CVE-2022-41073 |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows RT 8.1 Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 for ARM64-based Systems Windows 11 for x64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 8.1 for x64-based systems Windows 8.1 for x64-based systems Windows 8.1 for 32-bit systems Windows 8.1 for 32-bit systems Windows 7 for x64-based Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Datacenter: Azure Edition (Hotpatch) Windows Server 2022 (Server Core installation) Windows Server 2022 Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |
解决方案
1.官方修复建议
微软官方已更新受影响软件的安全补丁，用户可根据不同系统版本下载安装对应的安全补丁，安全更新链接如下：
1. https://msrc.microsoft.com/update-guide/zh-CN/vulnerability/CVE-2022-41091
-
https://msrc.microsoft.com/update-guide/zh-CN/vulnerability/CVE-2022-41040
-
https://msrc.microsoft.com/update-guide/zh-CN/vulnerability/CVE-2022-41082
-
https://msrc.microsoft.com/update-guide/zh-CN/vulnerability/CVE-2022-41128
-
https://msrc.microsoft.com/update-guide/zh-CN/vulnerability/CVE-2022-41125
-
https://msrc.microsoft.com/update-guide/zh-CN/vulnerability/CVE-2022-41073
2.深信服解决方案
1.安全监测
支持对 CVE-2022-41040 的监测，可依据流量收集实时监控业务场景中的受影响资产情况，快速检查受影响范围，相关产品及服务如下：
【深信服安全感知管理平台SIP】已发布检测方案。
【深信服安全托管服务MSS】已发布检测方案。
2.安全防护 支持对 CVE-2022-41040 的防御，可阻断攻击者针对该事件的入侵行为，相关产品及服务如下：【深信服下一代防火墙AF】已发布防护方案。
【深信服Web应用防火墙WAF】已发布防护方案。
【深信服安全托管服务MSS】已发布防护方案。
参考链接
https://msrc.microsoft.com/update-guide/releaseNote/2022-Nov
时间轴
2022/11/9
微软例行补丁日，微软官网发布漏洞安全公告。
2022/11/9
深信服千里目安全技术中心发布安全通告。
点击阅读原文，及时关注并登录深信服智安全平台，可轻松查询漏洞相关解决方案。