微软2月清静更新多个产品高危误差通告

2022-02-10

一. 误差概述

2月9日，九游老哥科技CERT监测到微软宣布2月清静更新补丁，修复了48个清静问题，涉及Windows、Microsoft Office、Microsoft Dynamics、Azure等普遍使用的产品，其中包括权限提升、远程代码执行等高危误差类型。

本月微软月度更新修复的误差中，不保存严重水平为要害（Critical）的误差，主要（Important）误差有48个，其中包括1个0day误差：

Windows Kernel 权限提升误差（CVE-2022-21989）

请相关用户尽快更新补丁举行防护，完整误差列表请参考附录。

九游老哥远程清静评估系统（RSAS）已具备微软此次补丁更新中大部分误差的检测能力（包括CVE-2022-21984、CVE-2022-22005、CVE-2022-21999、CVE-2022-21995等高危误差），请相关用户关注九游老哥远程清静评估系统系统插件升级包的更新，实时升级至最新版本，官网链接：http://update.nsfocus.com/update/listRsasDetail/v/vulsys

参考链接：

https://msrc.microsoft.com/update-guide/en-us/releaseNote/2022-Feb

二. 重点误差简述

凭证产品盛行度和误差主要性筛选出此次更新中包括影响较大的误差，请相关用户重点举行关注：

Windows Kernel 权限提升误差（CVE-2022-21989）：

Windows Kernel保存权限提升误差，由于Windows Kernel中保存界线过失，可导致缓冲区溢出。具有低权限的攻击者在特定情形下可使用该误差在目的系统上提升至SYSTEM权限并执行恣意代码。

官方通告链接：

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21989

Windows DNS Server远程代码执行误差（CVE-2022-21984）：

当DNS服务器启用动态更新的情形下，具有低权限的攻击者可使用该误差实现对DNS服务器接受，最终导致在目的系统上以用户权限执行恣意代码，且无需用户交互。CVSS评分为8.8。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21984

Microsoft SharePoint Server 远程代码执行误差（CVE-2022-22005）：

由于SharePoint Server中保存误差，该误差允许经由身份验证的用户在 SharePoint服务器上执行恣意.NET代码与Web应用程序。当攻击者拥有“治理列表”权限时，才华乐成使用该误差。CVSS评分为8.8。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22005

Windows Print Spooler权限提升误差（CVE-2022-21999）：

Windows打印后台服务中保存误差，经由身份验证的外地攻击者使用该误差在目的系统上以SYSTEM权限执行恣意代码。CVSS评分为7.8。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999

Windows Hyper-V 远程代码执行误差（CVE-2022-21995）：

Windows Hyper-V是Microsoft的外地虚拟机治理程序，在用户交互条件下，攻击者在特定情形可使用该误差绕过用户信托界线，最终导致在Hyper-V主机上以用户权限执行恣意代码。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21995

Azure Data Explorer诱骗误差（CVE-2022-23256）：

Azure Data Explorer保存诱骗误差，攻击者可通过制作恶意的url，当乐成诱导用户在受影响的系统上翻开恶意url后，可在目的系统上以该用户权限执行恣意代码。CVSS评分为8.1。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23256

Microsoft Dynamics GP远程代码执行误差（CVE-2022-23274）：

Microsoft Dynamics GP保存远程代码执行误差，经由身份验证的攻击者可使用该误差将特制的SQL请求发送至 Dynamics GP Web 服务器，最终在目的服务器上执行恣意代码。

官方通告链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23274

三. 影响规模

以下为重点关注误差的受影响产品版本，其他误差影响产品规模请参阅官方通告链接。

误差编号	受影响产品版本
CVE-2022-21989 CVE-2022-21999	Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows RT 8.1 Windows 8.1 for x64-based systems Windows 8.1 for 32-bit systems Windows 7 for x64-based Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 for ARM64-based Systems Windows 11 for x64-based Systems Windows Server, version 20H2 (Server Core Installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Azure Edition Core Hotpatch Windows Server 2022 (Server Core installation) Windows Server 2022 Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems
CVE-2022-21984	Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 for ARM64-based Systems Windows 11 for x64-based Systems Windows Server, version 20H2 (Server Core Installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Azure Edition Core Hotpatch Windows Server 2022 (Server Core installation) Windows Server 2022 Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems
CVE-2022-22005	Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
CVE-2022-21995	Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 for x64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 11 for x64-based Systems Windows Server, version 20H2 (Server Core Installation) Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Azure Edition Core Hotpatch Windows Server 2022 (Server Core installation) Windows Server 2022 Windows 10 Version 21H1 for x64-based Systems Windows 10 Version 1909 for x64-based Systems Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for x64-based Systems
CVE-2022-23256	Azure Data Explorer
CVE-2022-23274	Microsoft Dynamics GP