- 产品与解决方案
- 行业解决方案
- 服务
- 支持
- 合作伙伴
- 新华三人才研学中心
- 关于我们
新华三盾山实验室
2023/08/09
2023年8月，新华三盾山实验室监测发现Microsoft官方发布了8月安全更新，共发布74个漏洞的补丁信息，主要修复了Windows Kernel、Microsoft Office、Microsoft Exchange Server 等产品中的漏洞。在此次更新的补丁中，有6个漏洞被微软标记为严重漏洞，且Windows Search远程代码执行漏洞（CVE-2023-36884）已存在在野利用，由于影响较大，新华三盾山实验室建议广大用户及时做好资产自查以及预防工作，以免遭受黑客攻击。
Windows Search中存在远程代码执行漏洞，未经身份验证的恶意攻击者通过构造特制的office文档并诱导受害者打开该文档，成功利用此漏洞可在目标系统上执行任意代码，获取目标系统的控制权限。
严重等级：高危 评分：7.5
Microsoft Outlook中存在特权提升漏洞，未经身份验证的恶意攻击者通过诱骗受害者打开特制文件，成功利用此漏洞可在目标系统上执行任意代码。
严重等级：高危 评分：7.8
Microsoft 消息队列中存在远程代码执行漏洞，由于Microsoft 消息队列中未对输入的数据进行过滤，未经身份验证的恶意攻击者成功利用该漏洞可在目标服务器上执行代码。
严重等级：严重 评分：9.8
Windows内核上存在权限提升漏洞，由于应用程序没有在Windows内核中正确施加安全限制，恶意攻击者成功利用此漏洞可将普通权限提升至SYSTEM权限。
严重等级：高危 评分：7.8
Windows HTML平台存在安全特性绕过漏洞，当MSHTML平台未能验证特定URL的正确安全区域时，未经身份验证的远程攻击者构造特制的URL，诱导受害者访问比预期限制更低Internet安全区域中的URL来触发该漏洞。
严重等级：中危 评分：5.4
Microsoft Exchange Server上存在远程代码执行漏洞，经过身份验证的恶意攻击者通过PowerShell远程会话实现远程代码执行。攻击者可利用CVE-2023-35388可以在服务器邮箱后端获得NT AUTHORITY\SYSTEM的远程代码执行权限。
严重等级：高危 评分：8.0
该漏洞是由于未对用户输入的数据进行过滤，恶意攻击者通过向应用程序发送特制的请求，成功利用此漏洞可造成拒绝服务 (DoS) 攻击。
严重等级：高危 评分：7.5
CVE编号 | 受影响产品 |
CVE-2023-36884 CVE-2023-35385 CVE-2023-36911 CVE-2023-36910 CVE-2023-35380 CVE-2023-35359 CVE-2023-36900 | Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows Server 2022 (Server Core installation) |
CVE-2023-36895 | Microsoft 365 Apps for Enterprise for 32-bit Systems Microsoft 365 Apps for Enterprise for 64-bit Systems Microsoft Office 2013 RT Service Pack 1 Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft Office 2013 Service Pack 1 (64-bit editions) Microsoft Office 2016 (32-bit edition) Microsoft Office 2016 (64-bit edition) Microsoft Office 2019 for 32-bit editions Microsoft Office 2019 for 64-bit editions Microsoft Office 2019 for Mac Microsoft Office LTSC 2021 for 32-bit editions Microsoft Office LTSC 2021 for 64-bit editions Microsoft Office LTSC for Mac 2021 |
CVE-2023-29328 CVE-2023-29330 | Microsoft Teams for Mac Microsoft Teams for Android Microsoft Teams for iOS Microsoft Teams for Desktop |
CVE-2023-35382 | Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows Server 2022 (Server Core installation) |
CVE-2023-35386 | Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows Server 2022 (Server Core installation) |
CVE-2023-35384 | Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 22H2 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems |
CVE-2023-38180 | Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 .NET 7.0 .NET 6.0 ASP.NET Core 2.1 |
CVE-2023-38182 CVE-2023-35388 | Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 13 |
目前，微软官方已经发布针对此漏洞的补丁程序，建议用户通过以下链接尽快安装补丁程序：
https://msrc.microsoft.com/update-guide/releaseNote/2023-Aug
https://msrc.microsoft.com/update-guide/releaseNote/2023-Aug
产品与解决方案
售前咨询
售后咨询
人工在线咨询
