2022年11月“微软补丁日” 多个产品高危漏洞风险通告

06414

微软发布了2022年11月的例行安全更新公告，共涉及漏洞数64个。本次发布涉及Microsoft Windows、Azure、Microsoft Dynamics、Exchange Server、Office、SharePoint Server、Network Policy Server (NPS)、Windows BitLocker等多个软件的安全更新。

为避免您的业务受影响，芒竹云安全建议您及时开展安全自查，如在受影响范围，请您及时进行更新修复，避免被外部攻击者入侵。

漏洞详情

在此次公告中以下漏洞需要微软用户重点关注：
Windows Scripting Languages远程代码执行漏洞（CVE-2022-41128）：
漏洞cvss评分8.8，被官方标记为已发现在野利用。该漏洞主要影响JScript9 脚本语言，该漏洞需要攻击者诱导 Windows 用户访问搭建的恶意服务器才可利用。

Windows Print Spooler 权限提升漏洞（CVE-2022-41073）：
漏洞cvss评分7.8，被官方标记为已发现在野利用。漏洞与PrintNightmare类似，攻击者可利用Print Spooler服务漏洞获得system权限。

Windows CNG 密钥隔离服务权限提升漏洞（CVE-2022-41125）：
漏洞cvss评分7.8，被官方标记为已发现在野利用。攻击者可利用Windows CNG Key Isolation Service漏洞获得system权限。

Microsoft Exchange Server 权限提升漏洞（CVE-2022-41080）：
漏洞cvss评分8.8，被官方标记为很有可能被利用。

Microsoft Exchange Server远程代码执行漏洞（CVE-2022-41082）：
漏洞cvss评分8.8，漏洞已于9月29日被披露发现0day利用，目前已发布补丁。该漏洞类似于proxyshell，已经获得身份验证的远程攻击者，可利用 SSRF 提升权限并在 Exchange 服务器上执行任意 PowerShell 代码。

Microsoft Exchange Server 权限提升漏洞（CVE-2022-41040）：
漏洞cvss评分8.8，漏洞已于9月29日与CVE-2022-41082同时被披露，目前已发布补丁，请及时修复。

风险等级

高风险

漏洞风险

攻击者利用该漏洞可导致远程代码执行或权限提升等危害

影响版本

CVE-2022-41128：
Windows Server 2012 R2
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41073：
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41125：
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41080 / CVE-2022-41082 / CVE-2022-41040：
Microsoft Exchange Server 2016 Cumulative Update 22
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft Exchange Server 2016 Cumulative Update 23

安全版本

微软2022年11月最新补丁

修复建议

官方已发布漏洞补丁及修复版本，请评估业务是否受影响后，酌情升级至安全版本

【备注】：建议您在升级前做好数据备份工作，避免出现意外

漏洞参考

https://msrc.microsoft.com/update-guide/releaseNote/2022-Nov”>https://msrc.microsoft.com/update-guide/releaseNote/2022-Nov
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128″>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41073″>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41073
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41125″>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41125
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41080″>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41080
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082″>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040″>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040
https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/”>https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

© 版权声明
版权声明 1、本网站名称：芒竹博客
2、本站永久网址：https://blog.mangzhuyun.com
3、本网站的文章部分内容可能来源于网络，仅供大家学习与参考，如有侵权，请联系站长QQ2099530862进行删除处理。
4、本站一切资源不代表本站立场，并不代表本站赞同其观点和对其真实性负责。
5、本站一律禁止以任何方式发布或转载任何违法的相关信息，访客发现请向站长举报
6、本站资源大多存储在云盘，如发现链接失效，请联系我们我们会第一时间更新。

THE END
线报资讯
喜欢就支持一下吧
点赞14赞赏 分享
芒竹博客官方的头像-芒竹博客钻石会员
2022年全国电信DNS服务器排行！2022年DNS服务器汇总-芒竹博客
2022年全国电信DNS服务器排行！2022年DNS服务器汇总
2022年全国电信DNS服务器排行！2022年DNS服务器汇总
2年前 1655
鹤峰县客运班线表-芒竹博客
鹤峰县客运班线表
鹤峰县客运班线表
1年前 914
【赞助商推荐旗舰厂商】无忧云：高防服务器优惠活动-芒竹博客
【赞助商推荐旗舰厂商】无忧云：高防服务器优惠活动
【赞助商推荐旗舰厂商】无忧云：高防服务器优惠活动
2年前 696
Windows2008扩展磁盘分区空间-芒竹博客
Windows2008扩展磁盘分区空间
Windows2008扩展磁盘分区空间
2年前 657
腾讯QQ各种封号申诉地址合集[经验教程]-芒竹博客
腾讯QQ各种封号申诉地址合集[经验教程]
腾讯QQ各种封号申诉地址合集[经验教程]
2年前 651
联通FTTR设备没有实际华为PON口，需要小光猫带怎么配置？-芒竹博客
联通FTTR设备没有实际华为PON口，需要小光猫带怎么配置？
联通FTTR设备没有实际华为PON口，需要小光猫带怎么配置？
1年前 644
相关推荐
鹤峰县客运班线表-芒竹博客
鹤峰县客运班线表
鹤峰县客运班线表
1年前 914
相约一起看看花吧-芒竹博客
相约一起看看花吧
相约一起看看花吧
1年前 607
重要通知：近期部分骗子，冒充我司高管的重要声明-芒竹博客
重要通知：近期部分骗子，冒充我司高管的重要声明
重要通知：近期部分骗子，冒充我司高管的重要声明
1年前 587
芒竹智能云:取消鹤峰分公司（总部搬迁至恩施州）-芒竹博客
芒竹智能云:取消鹤峰分公司（总部搬迁至恩施州）
芒竹智能云:取消鹤峰分公司（总部搬迁至恩施州）
1年前 574
天然氧吧，中国之中，诗画鹤峰-芒竹博客
天然氧吧，中国之中，诗画鹤峰
天然氧吧，中国之中，诗画鹤峰
1年前 551
芒竹智能云：我司将前往来凤投放共享电单车-芒竹博客
芒竹智能云：我司将前往来凤投放共享电单车
芒竹智能云：我司将前往来凤投放共享电单车
1年前 532
评论 抢沙发
头像
欢迎您留下宝贵的见解！
提交
头像

昵称

取消
昵称

请填写用户信息：

  • 昵称(必填)
  • 邮箱(必填)
表情
[aoman][baiyan][bishi][bizui][cahan][ciya][dabing][daku][deyi][doge][fadai][fanu][fendou][ganga][guzhang][haixiu][hanxiao][zuohengheng][zhuakuang][zhouma][zhemo][zhayanjian][zaijian][yun][youhengheng][yiwen][yinxian][xu][xieyanxiao][xiaoku][xiaojiujie][xia][wunai][wozuimei][weixiao][weiqu][tuosai][tu][touxiao][tiaopi][shui][se][saorao][qiudale][se][qinqin][qiaoda][piezui][penxue][nanguo][liulei][liuhan][lenghan][leiben][kun][kuaikule][ku][koubi][kelian][keai][jingya][jingxi][jingkong][jie][huaixiao][haqian][aini][OK][qiang][quantou][shengli][woshou][gouyin][baoquan][aixin][bangbangtang][xiaoyanger][xigua][hexie][pijiu][lanqiu][juhua][hecai][haobang][caidao][baojin][chi][dan][kulou][shuai][shouqiang][yangtuo][youling]
代码

请输入代码：

确认
图片