時間：2023-03-20???瀏覽：850???作者：王德靈
近日，微軟官方發(fā)布了多個安全漏洞的公告，其中微軟產(chǎn)品本身漏洞77個，影響到微軟產(chǎn)品的其他廠商漏洞9個。包括Microsoft Windows Remote Procedure Call 安全漏洞（CNNVD-202303-1051、CVE-2023-21708）、Microsoft Windows HTTP Protocol Stack 安全漏洞（CNNVD-202303-1026、CVE-2023-23392）等多個漏洞。成功利用上述漏洞的攻擊者可以在目標(biāo)系統(tǒng)上執(zhí)行任意代碼、獲取用戶數(shù)據(jù)，提升權(quán)限等。微軟多個產(chǎn)品和系統(tǒng)受漏洞影響。目前，微軟官方已經(jīng)發(fā)布了漏洞修復(fù)補丁，建議用戶及時確認(rèn)是否受到漏洞影響，盡快采取修補措施。
一、 漏洞介紹
2023年3月14日，微軟發(fā)布了2023年3月份安全更新，共86個漏洞的補丁程序，CNNVD對這些漏洞進行了收錄。本次更新主要涵蓋了Microsoft Windows 和 Windows 組件、Microsoft PostScript Printer Driver、Microsoft Windows HTTP Protocol Stack、Microsoft Graphics Component、Microsoft Windows Hyper-V、Microsoft Windows Point-to-Point Tunneling Protocol等。CNNVD對其危害等級進行了評價，其中超危漏洞4個，高危漏洞48個，中危漏洞32個，低危漏洞1個。微軟多個產(chǎn)品和系統(tǒng)版本受漏洞影響，具體影響范圍可訪問微軟官方網(wǎng)站查詢：
https://portal.msrc.microsoft.com/zh-cn/security-guidance
二、漏洞詳情
此次更新共包括74個新增漏洞的補丁程序，其中超危漏洞4個，高危漏洞42個，中危漏洞27個，低危漏洞1個。
序號 | 漏洞名稱 | CNNVD編號 | CVE編號 | 危害等級 | 官方鏈接 |
1 | Microsoft Windows Remote Procedure Call 安全漏洞 | CNNVD-202303-1051 | CVE-2023-21708 | 超危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21708 |
2 | Microsoft Windows HTTP Protocol Stack 安全漏洞 | CNNVD-202303-1026 | CVE-2023-23392 | 超危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23392 |
3 | Microsoft Outlook 安全漏洞 | CNNVD-202303-1036 | CVE-2023-23397 | 超危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397 |
4 | Microsoft Internet Control Message Protocol 安全漏洞 | CNNVD-202303-1075 | CVE-2023-23415 | 超危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415 |
5 | Microsoft Service Fabric 安全漏洞 | CNNVD-202303-1016 | CVE-2023-23383 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23383 |
6 | Microsoft Windows Point-to-Point Protocol over Ethernet 安全漏洞 | CNNVD-202303-1017 | CVE-2023-23385 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23385 |
7 | Microsoft Bluetooth Driver 安全漏洞 | CNNVD-202303-1019 | CVE-2023-23388 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23388 |
8 | Microsoft Windows BrokerInfrastructure 安全漏洞 | CNNVD-202303-1032 | CVE-2023-23393 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23393 |
9 | Microsoft Excel 安全漏洞 | CNNVD-202303-1038 | CVE-2023-23398 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23398 |
10 | Microsoft Excel 安全漏洞 | CNNVD-202303-1039 | CVE-2023-23399 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23399 |
11 | Microsoft DNS Server 安全漏洞 | CNNVD-202303-1054 | CVE-2023-23400 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23400 |
12 | Microsoft Windows Codecs Library 安全漏洞 | CNNVD-202303-1056 | CVE-2023-23401 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23401 |
13 | Microsoft Windows Codecs Library 安全漏洞 | CNNVD-202303-1057 | CVE-2023-23402 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23402 |
14 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1040 | CVE-2023-23403 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23403 |
15 | Microsoft Windows Point-to-Point Tunneling Protocol 安全漏洞 | CNNVD-202303-1058 | CVE-2023-23404 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23404 |
16 | Microsoft Windows Remote Procedure Call Runtime 安全漏洞 | CNNVD-202303-1060 | CVE-2023-23405 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23405 |
17 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1062 | CVE-2023-23406 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23406 |
18 | Microsoft Windows Point-to-Point Protocol over Ethernet 安全漏洞 | CNNVD-202303-1064 | CVE-2023-23407 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23407 |
19 | Microsoft HTTP.sys 安全漏洞 | CNNVD-202303-1072 | CVE-2023-23410 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23410 |
20 | Microsoft Windows Accounts Control 安全漏洞 | CNNVD-202303-1087 | CVE-2023-23412 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23412 |
21 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1076 | CVE-2023-23413 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23413 |
22 | Microsoft Windows Point-to-Point Protocol over Ethernet 安全漏洞 | CNNVD-202303-1077 | CVE-2023-23414 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23414 |
23 | Microsoft Windows Cryptographic Services 安全漏洞 | CNNVD-202303-1079 | CVE-2023-23416 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23416 |
24 | Microsoft Windows Partition Management Driver 安全漏洞 | CNNVD-202303-1073 | CVE-2023-23417 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23417 |
25 | Microsoft Windows Resilient File System (ReFS) 安全漏洞 | CNNVD-202303-1070 | CVE-2023-23418 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23418 |
26 | Microsoft Windows Resilient File System (ReFS) 安全漏洞 | CNNVD-202303-1068 | CVE-2023-23419 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23419 |
27 | Microsoft Windows Kernel 安全漏洞 | CNNVD-202303-1065 | CVE-2023-23420 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23420 |
28 | Microsoft Windows Kernel 安全漏洞 | CNNVD-202303-1063 | CVE-2023-23421 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23421 |
29 | Microsoft Windows Kernel 安全漏洞 | CNNVD-202303-1061 | CVE-2023-23422 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23422 |
30 | Microsoft Windows Kernel 安全漏洞 | CNNVD-202303-1059 | CVE-2023-23423 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23423 |
31 | Microsoft Windows Internet Key Exchange (IKE) Protocol 安全漏洞 | CNNVD-202303-1071 | CVE-2023-24859 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24859 |
32 | Microsoft Windows Win32K 安全漏洞 | CNNVD-202303-1052 | CVE-2023-24861 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24861 |
33 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1066 | CVE-2023-24864 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24864 |
34 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1046 | CVE-2023-24867 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24867 |
35 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1045 | CVE-2023-24868 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24868 |
36 | Microsoft Windows Remote Procedure Call Runtime 安全漏洞 | CNNVD-202303-1042 | CVE-2023-24869 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24869 |
37 | Microsoft Windows Bluetooth Service 安全漏洞 | CNNVD-202303-1041 | CVE-2023-24871 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24871 |
38 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1037 | CVE-2023-24872 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24872 |
39 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1035 | CVE-2023-24876 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24876 |
40 | Microsoft Edge 安全漏洞 | CNNVD-202303-1024 | CVE-2023-24892 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24892 |
41 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1018 | CVE-2023-24907 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24907 |
42 | Microsoft Windows Remote Procedure Call Runtime 安全漏洞 | CNNVD-202303-1015 | CVE-2023-24908 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24908 |
43 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1013 | CVE-2023-24909 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24909 |
44 | Microsoft Graphics Component 安全漏洞 | CNNVD-202303-1014 | CVE-2023-24910 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24910 |
45 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1010 | CVE-2023-24913 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24913 |
46 | Microsoft OneDrive 安全漏洞 | CNNVD-202303-1001 | CVE-2023-24930 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24930 |
47 | Microsoft Defender 安全漏洞 | CNNVD-202303-1021 | CVE-2023-23389 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23389 |
48 | Microsoft Office for Android 安全漏洞 | CNNVD-202303-1023 | CVE-2023-23391 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23391 |
49 | Microsoft Client Server Run-time Subsystem (CSRSS) 安全漏洞 | CNNVD-202303-1029 | CVE-2023-23394 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23394 |
50 | Microsoft Excel 安全漏洞 | CNNVD-202303-1033 | CVE-2023-23396 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23396 |
51 | Microsoft Azure Apache Ambari 安全漏洞 | CNNVD-202303-1067 | CVE-2023-23408 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23408 |
52 | Microsoft Client Server Run-time Subsystem (CSRSS) 安全漏洞 | CNNVD-202303-1069 | CVE-2023-23409 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23409 |
53 | Microsoft Windows Hyper-V 安全漏洞 | CNNVD-202303-1074 | CVE-2023-23411 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23411 |
54 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1044 | CVE-2023-24856 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24856 |
55 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1055 | CVE-2023-24857 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24857 |
56 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1053 | CVE-2023-24858 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24858 |
57 | Microsoft Windows Secure Channel 安全漏洞 | CNNVD-202303-1050 | CVE-2023-24862 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24862 |
58 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1049 | CVE-2023-24863 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24863 |
59 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1048 | CVE-2023-24865 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24865 |
60 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1047 | CVE-2023-24866 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24866 |
61 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1043 | CVE-2023-24870 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24870 |
62 | Microsoft Dynamics 安全漏洞 | CNNVD-202303-1031 | CVE-2023-24879 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24879 |
63 | Microsoft Defender SmartScreen 安全漏洞 | CNNVD-202303-1034 | CVE-2023-24880 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880 |
64 | Microsoft OneDrive 安全漏洞 | CNNVD-202303-1028 | CVE-2023-24882 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24882 |
65 | Microsoft OneDrive 安全漏洞 | CNNVD-202303-1027 | CVE-2023-24890 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24890 |
66 | Microsoft Dynamics 安全漏洞 | CNNVD-202303-1025 | CVE-2023-24891 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24891 |
67 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1020 | CVE-2023-24906 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24906 |
68 | Microsoft PostScript Printer Driver 安全漏洞 | CNNVD-202303-1011 | CVE-2023-24911 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24911 |
69 | Microsoft Dynamics 安全漏洞 | CNNVD-202303-1008 | CVE-2023-24919 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24919 |
70 | Microsoft Dynamics 安全漏洞 | CNNVD-202303-1007 | CVE-2023-24920 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24920 |
71 | Microsoft Dynamics 安全漏洞 | CNNVD-202303-1006 | CVE-2023-24921 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24921 |
72 | Microsoft Dynamics 安全漏洞 | CNNVD-202303-1005 | CVE-2023-24922 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24922 |
73 | Microsoft OneDrive 安全漏洞 | CNNVD-202303-1004 | CVE-2023-24923 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24923 |
74 | Microsoft SharePoint 安全漏洞 | CNNVD-202303-1030 | CVE-2023-23395 | 低危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23395 |
此次更新共包括3個更新漏洞的補丁程序，其中高危漏洞2個，中危漏洞1個。
序號 | 漏洞名稱 | CNNVD編號 | CVE編號 | 危害等級 | 官方鏈接 |
1 | Microsoft Hyper-V安全漏洞 | CNNVD-202204-3177 | CVE-2022-23257 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23257 |
2 | Microsoft Dynamics 安全漏洞 | CNNVD-202212-3159 | CVE-2022-41127 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41127 |
3 | Windows DCOM Server 安全特征問題漏洞 | CNNVD-202106-546 | CVE-2021-26414 | 中危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26414 |
此次更新共包括9個影響微軟產(chǎn)品的其他廠商漏洞的補丁程序，其中高危漏洞4個，中危漏洞4個，低危漏洞1個。
序號 | 漏洞名稱 | CNNVD編號 | CVE編號 | 危害等級 | 廠商 | 官方鏈接 |
1 | TCG TPM 緩沖區(qū)錯誤漏洞 | CNNVD-202302-2422 | CVE-2023-1017 | 高危 | TCG | https://trustedcomputinggroup.org/resource/errata-for-tpm-library-specification-2-0/ |
2 | Git 代碼問題漏洞 | CNNVD-202302-1069 | CVE-2023-22743 | 高危 | Git | https://github.com/git-for-windows/git/security/advisories/GHSA-p2x9-prp4-8gvq |
3 | Git 代碼問題漏洞 | CNNVD-202302-1071 | CVE-2023-23618 | 高危 | Git | https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c |
4 | Git 路徑遍歷漏洞 | CNNVD-202302-1164 | CVE-2023-23946 | 高危 | Git | https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd |
5 | 多款A(yù)MD處理器安全漏洞 | CNNVD-202207-891 | CVE-2022-23825 | 中危 | AMD | https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037 |
6 | curl 資源管理錯誤漏洞 | CNNVD-202212-3687 | CVE-2022-43552 | 中危 | 個人開發(fā)者 | https://curl.se/docs/CVE-2022-43552.html |
7 | TCG TPM 緩沖區(qū)錯誤漏洞 | CNNVD-202302-2314 | CVE-2023-1018 | 中危 | TCG | https://trustedcomputinggroup.org/resource/errata-for-tpm-library-specification-2-0/ |
8 | Git 后置鏈接漏洞 | CNNVD-202302-1136 | CVE-2023-22490 | 中危 | 個人開發(fā)者 | https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd |
9 | AMD CPU 安全漏洞 | CNNVD-202207-892 | CVE-2022-23816 | 低危 | AMD | https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037 |
三、修復(fù)建議
目前，微軟官方已經(jīng)發(fā)布補丁修復(fù)了上述漏洞，建議用戶及時確認(rèn)漏洞影響，盡快采取修補措施。微軟官方補丁下載地：
https://msrc.microsoft.com/update-guide/en-us
CNNVD將繼續(xù)跟蹤上述漏洞的相關(guān)情況，及時發(fā)布相關(guān)信息。如有需要，可與CNNVD聯(lián)系。聯(lián)系方式: cnnvdvul@itsec.gov.cn
文章來源：國家信息安全漏洞庫