【漏洞通告】微软补丁日安全通告|7月份
【漏洞通告】微软补丁日安全通告|7月份
深益研究实验室 深信服千里目安全技术中心 2023-07-13 21:24
2023年7月13日（北京时间），微软发布了安全更新，共发布了130个CVE的补丁程序，同比上月增加了36个。
在漏洞安全等级方面，存在9个标记等级为“Critical”的漏洞，121个漏洞被标记为“Important/High”等级的漏洞；在漏洞类型方面，主要有37个远程代码执行漏洞，33个权限提升漏洞以及18个信息泄露漏洞。
漏洞分析
2023年漏洞数量趋势
图 1 2023年微软补丁漏洞修复情况
总体上来看，微软本月发布的补丁数量为130个，有9个 Critical 漏洞补丁。
千里目安全技术中心在综合考虑往年微软公布漏洞数量的数据统计和今年的特殊情况，初步估计微软在今年八月份公布的漏洞数将比今年七月份少。漏洞数量将会维持在90个左右。
历史微软补丁日7月漏洞对比
2020-2023年，7月份的漏洞数趋势如下图：
图 2 微软近年7月Windows补丁漏洞数量对比
2020-2023年，7月份的漏洞危险等级趋势和数量如下图：
图 3 微软近年7月漏洞危险等级对比
2020-2023年，7月份的漏洞各个类型数量对比如下图：
图 4 微软近年7月漏洞类型对比
从漏洞数量来看，今年相较去年增多。微软在2023年7月份爆发的漏洞相较于去年增多。本月出现了130个漏洞补丁，并且有9个 Critical 类型的漏洞补丁。
从漏洞的危险等级来看，相较去年“Critical”等级的漏洞数量增加，“Important/High”等级的漏洞数量增加，近两年相对历史数据而言总体漏洞数量变化较大。本月出现了121个“Important/High”等级的漏洞，相较去年增长了约48%；9个“Critical”类型的漏洞，相较去年增长了125%。
从漏洞类型来看，RCE类型的漏洞数量增加，DoS类型的漏洞数量增加，EoP类型的漏洞数量减少，仍然需要引起高度重视，尤其是RCE漏洞在配合社工手段的前提下，甚至可以直接接管整个局域网并进行进一步扩展攻击。
重要漏洞分析
漏洞分析
Office and Windows HTML 远程代码执行漏洞 CVE-2023-36884
Microsoft Office是由微软公司开发的办公软件套装，包含Word, Excel, PowerPoint等办公工具。
其中存在远程代码执行漏洞，攻击者可以利用该漏洞在目标系统执行任意代码。该漏洞存在在野利用，经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Microsoft Outlook 安全功能绕过漏洞 CVE-2023-35311
Microsoft Outlook是由微软公司所出品Microsoft Office内的个人信息管理系统软件，功能包括收发电子邮件、日历等等。它也是与Microsoft Exchange Server互相搭配的组群软件。
其中存在安全功能绕过漏洞，攻击者可以利用该漏洞绕过目标系统上的安全功能，做出规定之外的行为。漏洞存在在野利用，经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Windows 错误报告服务特权提升漏洞CVE-2023-36874
Windows错误报告会收集并提供使用互联网向微软服务器发送发生错误之后的调试信息。微软服务器会对该信息进行分析处理，并在有可行解决方案时将方案返回给使用者。
其中存在特权提升漏洞，攻击者可以利用该漏洞在目标系统上获取更高的权限。该漏洞存在在野利用，经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Windows MSHTML 平台特权提升漏洞 CVE-2023-32046
MSHTML，是微软Windows操作系统中Internet Explorer浏览器引擎的名称，负责将HTML和其他网页资源转化成用户设备上显示的可视化交互形式。
其中存在特权提升漏洞，攻击者可以利用该漏洞在目标系统上获取更高的权限。该漏洞存在在野利用，经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Windows SmartScreen 安全功能绕过漏洞 CVE-2023-32049
Microsoft SmartScreen，作为一款筛选工具，能够协助对抗病毒、防范网络钓鱼、提供针对恶意程序的保护。
其中存在安全功能绕过漏洞，攻击者可以利用该漏洞在绕过目标系统上的安全功能，做出规定之外的行为。漏洞存在在野利用，经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
影响范围
|
漏洞名称、CVE编号 |
受影响版本 |
|
Office and Windows HTML 远程代码执行漏洞 CVE-2023-36884 |
Microsoft Word 2013 Service Pack 1 (64-bit editions) Microsoft Word 2013 Service Pack 1 (32-bit editions) Microsoft Word 2016 (64-bit edition) Microsoft Word 2016 (32-bit edition) Microsoft Office LTSC 2021 for 32-bit editions Microsoft Office LTSC 2021 for 64-bit editions Microsoft Office 2019 for 64-bit editions Microsoft Office 2019 for 32-bit editions Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
|
Microsoft Outlook 安全功能绕过漏洞 CVE-2023-35311 |
Microsoft Outlook 2013 RT Service Pack 1 Microsoft Outlook 2013 (64-bit editions) Microsoft Outlook 2013 (32-bit editions) Microsoft Outlook 2016 (64-bit edition) Microsoft Office 2019 for 64-bit editions Microsoft Outlook 2016 (32-bit edition) Microsoft Office 2019 for 32-bit editions Microsoft Office LTSC 2021 for 64-bit editions Microsoft 365 Apps for Enterprise for 64-bit Systems Microsoft Office LTSC 2021 for 32-bit editions Microsoft 365 Apps for Enterprise for 32-bit Systems |
|
Windows 错误报告服务特权提升漏洞 CVE-2023-36874 |
Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2019 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems |
|
Windows MSHTML 平台特权提升漏洞 CVE-2023-32046 |
Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2012 Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core inst allation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
|
Windows SmartScreen 安全功能绕过漏洞 CVE-2023-32049 |
Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows Server 2019 (Server Core installation) Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
解决方案
官方修复建议
微软官方已更新受影响软件的安全补丁，用户可根据不同系统版本下载安装对应的安全补丁，安全更新链接如下：
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35311
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36874
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32046
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32049
参考链接
https://msrc.microsoft.com/update-guide/releaseNote/2023-Jul
时间轴
2023/7/13
微软例行补丁日，微软官网发布漏洞安全公告。
2023/7/13
深信服千里目安全技术中心发布安全公告。
点击阅读原文，及时关注并登录深信服智安全平台，可轻松查询漏洞相关解决方案。