【安全风险通告】PoC已扩散,Windows Print Spooler远程代码执行漏洞安全风险通告

  • A+
所属分类:安全漏洞
【安全风险通告】PoC已扩散,Windows Print Spooler远程代码执行漏洞安全风险通告

奇安信CERT

致力于第一时间为企业级用户提供安全风险通告有效解决方案。




风险通告



近日,奇安信CERT监测到GITHUB上有安全研究人员公布了Windows Print Spooler远程代码执行漏洞(CVE-2021-1675)POC,Windows Print Spooler是打印后台处理服务,即管理所有本地和网络打印队列及控制所有打印工作,Windows Print Spooler 存在权限提升漏洞,经过身份认证的攻击者可利用此漏洞使 Spooler 服务加载恶意 DLL,从而获取权限提升。

POC已扩散,EXP已公开,官方已有可更新版本,鉴于漏洞危害较大,建议用户及时安装更新补丁。



当前漏洞状态



细节是否公开

PoC状态

EXP状态

在野利用

已公开

已公开

未知




漏洞描述

Windows Print Spooler是打印后台处理服务,即管理所有本地和网络打印队列及控制所有打印工作。Windows Print Spooler 存在权限提升漏洞,经过身份认证的攻击者可利用此漏洞使 Spooler 服务加载恶意 DLL,从而获取权限提升。利用此漏洞需身份认证,攻击者可通过多种方式获得身份认证信息。在域环境中合适的条件下,未经身份验证的远程攻击者可利用该漏洞以SYSTEM权限在域控制器上执行任意代码,从而获得整个域的控制权。

POC已扩散,EXP已公开,官方已有可更新版本,鉴于漏洞危害较大,建议用户及时安装更新补丁。



风险等级

奇安信 CERT风险评级为:高危
风险等级:蓝色(一般事件)



影响范围

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems

Windows 7 for x64-based Systems Service Pack 1

Windows 7 for 32-bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64-based Systems

Windows 10 Version 2004 for ARM64-based Systems

Windows 10 Version 2004 for 32-bit Systems

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows 10 Version 1909 for ARM64-based Systems

Windows 10 Version 1909 for x64-based Systems

Windows 10 Version 1909 for 32-bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems



处置建议

1、安装补丁

链接地址:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675#securityUpdates



参考资料

[1]https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675



时间线

2021年6月29日,奇安信 CERT发布安全风险通告


【安全风险通告】PoC已扩散,Windows Print Spooler远程代码执行漏洞安全风险通告点击阅读原文

到奇安信NOX-安全监测平台查询更多漏洞详情






【安全风险通告】PoC已扩散,Windows Print Spooler远程代码执行漏洞安全风险通告

奇安信CERT长期招募安全研究员

↓ ↓ ↓ 向下滑动图片了解更多↓ ↓ ↓


本文始发于微信公众号(奇安信 CERT):【安全风险通告】PoC已扩散,Windows Print Spooler远程代码执行漏洞安全风险通告

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: