安全预警,防患未然
首页 > 烽火狼烟

微软多个高危漏洞风险提示


漏洞概述


2021年05月12日,WebRAY烽火台实验室监测到微软官网发布了补丁通告,对包含CVE-2021-31166、CVE-2021-28476在内的55个漏洞进行了安全更新,其中CVE-2021-31166是一个可以以蠕虫方式传播利用的HTTP协议栈远程代码执行漏洞,未经授权的攻击者构造恶意数据包达到代码执行的目的;CVE-2021-28476表明Hyper-V也存在远程代码执行漏洞,攻击者利用内核读取无效地址时还会导致主机拒绝服务。WebRAY烽火台实验室建议相关用户及时更新安全补丁。

HTTP协议栈(http.sys)是一个Windows操作系统核心组件,能够让任何应用程序通过自身提供的接口以http协议进行信息通讯;Hyper-V是微软提出的一种系统管理程序虚拟化技术,能够实现桌面虚拟化。

WebRAY烽火台实验室将持续关注该漏洞进展,并第一时间为您更新该漏洞信息。


影响范围


漏洞编号影响版本
CVE-2021-31166

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64-based Systems

Windows 10 Version 2004 for ARM64-based Systems

Windows 10 Version 2004 for 32-bit System

CVE-2021-28476

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows 8.1 for x64-based systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 forx64-based Systems

Windows 10 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for x64-based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 1803 for x64-based Systems

Windows 10 Version 2004 for x64-based Systems

Windows Server, version 1909 (Server Core installation)

Windows 10 Version 1909 for x64-based Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for x64-based Systems


漏洞等级


WebRAY烽火台实验室风险评级:高危


修复建议


(1)通过Windows系统自动更新补丁,并在“Windows更新”->“查看更新历史记录”中确认更新是否成功安装;

(2)手动安装补丁包,参考链接:

https://msrc.microsoft.com/update-guide/releaseNote/2021-May

关于您的项目需求

关于您的项目需求

  • 获取短信验证码
点击“提交”,表明我理解并同意