- 产品与解决方案
- 行业解决方案
- 服务
- 支持
- 合作伙伴
- 关于我们
威胁预警团队
2021/09/08
MSHTML（又称为Trident）是微软Windows搭载的网页浏览器—Internet Explorer的排版引擎的名称，该组件主要应用在Internet Explorer 浏览器上，也用于在 Word、Excel 或 PowerPoint 文档中呈现 Web 托管的内容。近日，新华三攻防实验室威胁预警团队检测到微软官方紧急发布了Microsoft MSHTML 远程代码执行漏洞通告，漏洞编号为CVE-2021-40444，漏洞等级：高危。该漏洞已被检测到在野利用，且微软暂未发布修复补丁。
Microsoft MSHTML引擎存在远程代码执行漏洞，攻击者可通过构造含有恶意 ActiveX 控件的Microsoft Office 文档，发送给用户后诱导用户打开此文档来利用此漏洞。成功利用此漏洞的远程攻击者可在目标系统上以该用户权限执行任意代码。
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
高危
目前微软官方暂未发布针对此漏洞的补丁程序，可以通过在注册表中禁用所有 ActiveX 控件的安装来缓解此漏洞的攻击。
警告：如果注册表编辑器使用不当，可能会导致严重的问题，可能需要重新安装操作系统。建议做好备份后再执行以下操作：
使用注册表文件禁用 ActiveX 控件：
1、将以下内容粘贴到文本文件中并使用 .reg 文件扩展名保存：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"1001"=dword:00000003
"1004"=dword:00000003
2、双击 .reg 文件以将其应用到您的策略配置单元。
3、重新启动系统以确保应用新配置。
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
产品与解决方案
