微软5月安全更新补丁和多个高危漏洞风险提示

漏洞公告

微软官方发布了5月安全更新公告，包含了微软家族多个软件的安全更新补丁，包括：Microsoft Edge、Microsoft Office、Visual Studio Code、Windows NTLM、Windows RDP Client、Windows Win32K

等多个CVE安全漏洞补丁。请相关用户及时更新对应补丁修复漏洞。

参考链接：

https://msrc.microsoft.com/update-guide/releaseNote/2023-May

根据公告，此次更新中修复的Win32k 特权提升漏洞（CVE-2023-29336）、Win32k 特权提升漏洞（CVE-2023-24902）、Windows Network File System远程代码执行漏洞（CVE-2023-24941）、Windows 内核特权提升漏洞（CVE-2023-24949）、Microsoft SharePoint Server 欺骗漏洞（CVE-2023-24950）、Windows MSHTML 平台特权提升漏洞（CVE-2023-29324）、Windows OLE 远程代码执行漏洞（CVE-2023-29325）风险较大。其中Win32k 特权提升漏洞（CVE-2023-29336）存在在野利用，建议尽快安装安全更新补丁或采取临时缓解措施加固系统。

相关链接参考：

https://msrc.microsoft.com/update-guide/vulnerability/

一

影响范围

Win32k 特权提升漏洞（CVE-2023-29336）

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Win32k 特权提升漏洞（CVE-2023-24902）

Windows 11 Version 22H2 for x64-based Systems

Windows 11 Version 22H2 for ARM64-based Systems

Windows 11 version 21H2 for ARM64-based Systems

Windows 11 version 21H2 for x64-based Systems

Windows 网络文件系统远程代码执行漏洞（CVE-2023-24941）

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2012

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows Server 2022 (Server Core installation)

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows Server 2022

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 内核特权提升漏洞（CVE-2023-24949）

Windows 10 Version 22H2 for 32-bit Systems

Windows 10 Version 22H2 for ARM64-based Systems

Windows 10 Version 22H2 for x64-based Systems

Windows 11 Version 22H2 for x64-based Systems

Windows 11 Version 22H2 for ARM64-based Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 version 21H2 for ARM64-based Systems

Windows 11 version 21H2 for x64-based Systems

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows Server 2022

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

Microsoft SharePoint Server 欺骗漏洞（CVE-2023-24950）

Microsoft SharePoint Server Subscription Edition

Microsoft SharePoint Server 2019

Microsoft SharePoint Enterprise Server 2016

Windows MSHTML 平台特权提升漏洞（CVE-2023-29324）

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 R2

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2012

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 22H2 for 32-bit Systems

Windows 10 Version 22H2 for ARM64-based Systems

Windows 10 Version 22H2 for x64-based Systems

Windows 11 Version 22H2 for x64-based Systems

Windows 11 Version 22H2 for ARM64-based Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 version 21H2 for ARM64-based Systems

Windows 11 version 21H2 for x64-based Systems

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows Server 2022

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

Windows OLE 远程代码执行漏洞（CVE-2023-29325）

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 22H2 for 32-bit Systems

Windows 10 Version 22H2 for ARM64-based Systems

Windows 10 Version 22H2 for x64-based Systems

Windows 11 Version 22H2 for x64-based Systems

Windows 11 Version 22H2 for ARM64-based Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 version 21H2 for ARM64-based Systems

Windows 11 version 21H2 for x64-based Systems

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows Server 2022

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

5月安全公告列表，包含的其他漏洞快速阅读指引（非全部）

https://msrc.microsoft.com/update-guide/releaseNote/2023-May

CVE-2023-24881|Microsoft Teams信息泄露漏洞

CVE-2023-24898|Windows SMB拒绝服务漏洞

CVE-2023-24899|Windows图形组件权限提升漏洞

CVE-2023-24900|Windows NTLM Security Support Provider 信息泄露漏洞

CVE-2023-24901|Windows NFS Portmapper信息泄露漏洞

CVE-2023-24902|Win32k特权提升漏洞

CVE-2023-24903|Windows Secure Socket Tunneling Protocol (SSTP) 远程代码执行漏洞

CVE-2023-24904|Windows安装程序权限提升漏洞

CVE-2023-24905|远程桌面客户端远程代码执行漏洞

CVE-2023-24932|安全引导安全功能绕过漏洞

CVE-2023-24939|NFS服务器拒绝服务漏洞

CVE-2023-24940|Windows Pragmatic General Multicast (PGM) 拒绝服务漏洞

CVE-2023-24941|Windows Network File System远程代码执行漏洞

CVE-2023-24942|远程过程调用运行时拒绝服务漏洞

CVE-2023-24943|Windows Pragmatic General Multicast (PGM) 远程代码执行漏洞

CVE-2023-24944|Windows蓝牙驱动程序信息泄露漏洞

CVE-2023-24945|Windows iSCSI Target Service信息泄露漏洞

CVE-2023-24946|Windows备份服务权限提升漏洞

CVE-2023-24947|Windows蓝牙驱动程序远程代码执行漏洞

CVE-2023-24948|Windows蓝牙驱动程序权限提升漏洞

CVE-2023-24949|Windows内核权限提升漏洞

CVE-2023-24950|Microsoft SharePoint Server欺骗漏洞

CVE-2023-24953|Microsoft Excel远程代码执行漏洞

CVE-2023-24954|Microsoft SharePoint Server信息泄露漏洞

CVE-2023-24955|Microsoft SharePoint Server远程代码执行漏洞

CVE-2023-28251|Windows Driver Revocation List安全功能绕过漏洞

CVE-2023-28283|Windows Lightweight Directory Access Protocol (LDAP) 远程代码执行漏洞

CVE-2023-28290|远程桌面协议客户端信息泄露漏洞

CVE-2023-29324|Windows MSHTML平台权限提升漏洞

CVE-2023-29325|Windows OLE远程代码执行漏洞

CVE-2023-29333|Microsoft访问拒绝服务漏洞

CVE-2023-29335|Microsoft Word安全功能绕过漏洞

CVE-2023-29336|Win32k特权提升漏洞

CVE-2023-29338|Visual Studio代码信息泄露漏洞

CVE-2023-29340|AV1 Video Extension远程代码执行漏洞

CVE-2023-29341|AV1 Video Extension远程代码执行漏洞

CVE-2023-29343|用于Windows的SysInternal Sysmon特权提升漏洞

CVE-2023-29344|Microsoft Office远程代码执行漏洞

二

漏洞描述

Win32k 特权提升漏洞（CVE-2023-29336）：

细节是否公开	POC状态	EXP状态	在野利用
否	未公开	未公开	已发现

Win32k存在权限提升漏洞，成功利用此漏洞的攻击者可以获得 SYSTEM 权限。

Win32k 特权提升漏洞（CVE-2023-24902）：

细节是否公开	POC状态	EXP状态	在野利用
否	未公开	未公开	未发现

Win32k存在权限提升漏洞，成功利用此漏洞的攻击者可以获得 SYSTEM 权限。

Windows Network File System远程代码执行漏洞（CVE-2023-24941）：

细节是否公开	POC状态	EXP状态	在野利用
否	未公开	未公开	未发现

Windows 网络文件系统远程代码执行漏洞，攻击者通过对网络文件系统 (NFS) 服务进行未经身份验证的特制调用以触发远程代码执行 (RCE)。

Windows 内核特权提升漏洞（CVE-2023-24949）：

细节是否公开	POC状态	EXP状态	在野利用
否	未公开	未公开	未发现

Windows内核存在特权提升漏洞，成功利用此漏洞的攻击者可以获得 SYSTEM 权限。

Microsoft SharePoint Server 欺骗漏洞（CVE-2023-24950）：

细节是否公开	POC状态	EXP状态	在野利用
否	未公开	未公开	未发现

在基于网络的攻击中，有权在易受攻击的 SharePoint 服务器上创建站点的攻击者可以利用此漏洞导致服务器泄露其 NTLM 哈希。

Windows MSHTML 平台特权提升漏洞（CVE-2023-29324）：

细节是否公开	POC状态	EXP状态	在野利用
否	未公开	未公开	未发现

Windows MSHTML 平台特权提升漏洞，成功利用此漏洞的攻击者可以获得管理员权限。

Windows OLE 远程代码执行漏洞（CVE-2023-29325）：

细节是否公开	POC状态	EXP状态	在野利用
否	未公开	未公开	未发现

在电子邮件攻击情形中，攻击者可以通过向受害者发送特制电子邮件来利用此漏洞。对该漏洞的利用可能涉及受害者使用受影响的 Microsoft Outlook 软件版本打开特制电子邮件，或者受害者的 Outlook 应用程序显示特制电子邮件的预览。这可能导致攻击者在受害者的机器上执行远程代码。

三

缓解措施

高危：目前漏洞细节虽未公开，但是恶意攻击者可以通过补丁对比方式分析出漏洞触发点，并进一步开发漏洞利用代码，Microsoft已发布相关安全更新，鉴于漏洞的严重性，建议受影响的用户尽快修复。安恒信息将在产品的例行更新中加入相关攻击检测和防护能力。

（一）Windows 更新：

自动更新：

Microsoft Update默认启用，当系统检测到可用更新时，将会自动下载更新并在下一次启动时安装。

手动更新：

1、点击“开始菜单”或按Windows快捷键，点击进入“设置”

2、选择“更新和安全”，进入“Windows更新”（Windows 8、Windows 8.1、Windows Server 2012以及Windows Server 2012 R2可通过控制面板进入“Windows更新”，具体步骤为“控制面板”->“系统和安全”->“Windows更新”）

3、选择“检查更新”，等待系统将自动检查并下载可用更新。

4、重启计算机，安装更新系统重新启动后，可通过进入“Windows更新”->“查看更新历史记录”查看是否成功安装了更新。

（二）目前微软针对支持的产品已发布升级补丁修复了上述漏洞，请用户参考官方通告及时下载更新补丁。

补丁获取：

https://msrc.microsoft.com/update-guide/vulnerability

Windows Network File System远程代码执行漏洞（CVE-2023-24941）临时缓解措施：

此漏洞在 NFSV2.0 或 NFSV3.0 中不可利用。在更新可抵御此漏洞的 Windows 版本之前，您可以通过禁用 NFSV4.1 来减轻攻击。这可能会对您的生态系统产生不利影响，只能用作临时缓解措施。除非您已安装 2022 年 5 月的 Windows 安全更新，否则不应应用此缓解措施。这些更新解决了CVE-2022-26937，这是 NFSV2.0 和 NFSV3.0 中的一个严重漏洞。

安恒信息CERT

2023年5月

原文始发于微信公众号（安恒信息CERT）：微软5月安全更新补丁和多个高危漏洞风险提示