欢迎您来到腾讯云!积分商城

腾讯云腾讯云论坛

 找回密码
 立即注册
忘了密码?

扫一扫,访问微社区

快捷导航
搜索
查看: 1179|回复: 0

[安全通知] 关于微软2018年5月安全补丁更新说明

[复制链接]

217

主题

0

好友

1万

积分

腾讯云论坛管理组

Rank: 20Rank: 20

云币
33580
威望
13853
发表于 2018-5-9 11:25:38 |显示全部楼层
尊敬的腾讯云客户:
   您好,近日,腾讯云安全中心监测到微软近期发布了5月安全补丁更新,共披露了 67个安全漏洞,其中包含21个严重漏洞,攻击者可利用该漏洞实施权限提升、远程代码执行等攻击。
       为避免您的业务受影响,腾讯云安全中心建议您及时开展安全自查,如在受影响范围,请您及时进行更新修复,避免被外部攻击者入侵。

【漏洞详情】
   微软近期发布了5月安全补丁更新,共披露了Outlook, Office, Exchange, Edge, Internet Explorer等多个组件安全漏洞,其中需要重点关注的漏洞如下:
1)CVE-2018-8174 - Windows VBScript Engine 代码执行漏洞:
VBScript脚本执行引擎(vbscript.dll)存在代码执行漏洞,攻击者可以将恶意的VBScript嵌入到Office文件或者网站中,一旦用户不小心点击,远程攻击者可以获取当前用户权限执行脚本中的恶意代码。
   

漏洞详情列表如下:
严重漏洞如下(21个):
  • CVE-2018-0959 - Hyper-V Remote Code Execution Vulnerability
  • CVE-2018-0961 - Hyper-V vSMB Remote Code Execution Vulnerability
  • CVE-2018-8115 - Windows Host Compute Service Shim Remote Code Execution Vulnerability
  • CVE-2018-8178 - Microsoft Browser Memory Corruption Vulnerability
  • CVE-2018-0946 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-0951 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-0953 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-0954 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-0955 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8114 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8122 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8137 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-0945 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-1022 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8139 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8128 - Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8133 - Chakra Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-0943 - Chakra Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8130 - Chakra Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8177 - Chakra Scripting Engine Memory Corruption Vulnerability

重要漏洞列表(42个):
  • CVE-2018-8120 - Win32k Elevation of Privilege Vulnerability
  • CVE-2018-8123 - Microsoft Edge Memory Corruption Vulnerability
  • CVE-2018-8124 - Win32k Elevation of Privilege Vulnerability
  • CVE-2018-8147 - Microsoft Excel Remote Code Execution Vulnerability
  • CVE-2018-8148 - Microsoft Excel Remote Code Execution Vulnerability
  • CVE-2018-8157 - Microsoft Office Remote Code Execution Vulnerability
  • CVE-2018-8158 - Microsoft Office Remote Code Execution Vulnerability
  • CVE-2018-8161 - Microsoft Office Remote Code Execution Vulnerability
  • CVE-2018-8162 - Microsoft Excel Remote Code Execution Vulnerability
  • CVE-2018-8164 - Win32k Elevation of Privilege Vulnerability
  • CVE-2018-8165 - DirectX Graphics Kernel Elevation of Privilege Vulnerability
  • CVE-2018-8166 - Win32k Elevation of Privilege Vulnerability
  • CVE-2018-8167 - Windows Common Log File System Driver Elevation of Privilege Vulnerability
  • CVE-2018-8179 - Microsoft Edge Memory Corruption Vulnerability
  • CVE-2018-0765 - .NET and .NET Core Denial of Service Vulnerability
  • CVE-2018-0824 - Microsoft COM for Windows Remote Code Execution Vulnerability
  • CVE-2018-0854 - Windows Security Feature Bypass Vulnerability
  • CVE-2018-0958 - Windows Security Feature Bypass Vulnerability
  • CVE-2018-1021 - Microsoft Edge Information Disclosure Vulnerability
  • CVE-2018-1025 - Microsoft Browser Information Disclosure Vulnerability
  • CVE-2018-1039 - .NET Framework Device Guard Security Feature Bypass Vulnerability
  • CVE-2018-8112 - Microsoft Edge Security Feature Bypass Vulnerability
  • CVE-2018-8119 - Azure IoT SDK Spoofing Vulnerability
  • CVE-2018-8126 - Internet Explorer Security Feature Bypass Vulnerability
  • CVE-2018-8127 - Windows Kernel Information Disclosure Vulnerability
  • CVE-2018-8129 - Windows Security Feature Bypass Vulnerability
  • CVE-2018-8132 - Windows Security Feature Bypass Vulnerability
  • CVE-2018-8134 - Windows Elevation of Privilege Vulnerability
  • CVE-2018-8141 - Windows Kernel Information Disclosure Vulnerability
  • CVE-2018-8145 - Chakra Scripting Engine Memory Corruption Vulnerability
  • CVE-2018-8149 - Microsoft SharePoint Elevation of Privilege Vulnerability
  • CVE-2018-8150 - Microsoft Outlook Security Feature Bypass Vulnerability
  • CVE-2018-8151 - Microsoft Exchange Memory Corruption Vulnerability
  • CVE-2018-8152 - Microsoft Exchange Server Elevation of Privilege Vulnerability
  • CVE-2018-8155 - Microsoft SharePoint Elevation of Privilege Vulnerability
  • CVE-2018-8156 - Microsoft SharePoint Elevation of Privilege Vulnerability
  • CVE-2018-8159 - Microsoft Exchange Elevation of Privilege Vulnerability
  • CVE-2018-8160 - Microsoft Outlook Information Disclosure Vulnerability
  • CVE-2018-8163 - Microsoft Excel Information Disclosure Vulnerability
  • CVE-2018-8170 - Windows Image Elevation of Privilege Vulnerability
  • CVE-2018-8173 - Microsoft InfoPath Remote Code Execution Vulnerability
  • CVE-2018-8897 - Windows Kernel Elevation of Privilege Vulnerability

【风险等级】
  高风险

【漏洞风险】
   代码执行、权限提升、安全绕过以及信息泄露

【影响版本】
    目前已知受影响微软产品如下:
    Internet Explorer
    Microsoft Edge
    Microsoft Windows
    Microsoft Office and Microsoft Office Services and Web Apps
    ChakraCore
    Adobe Flash Player
    .NET Framework
    Microsoft Exchange Server
    Windows Host Compute Service Shim


【修复建议】
   目前微软官方均已发布漏洞修复更新,腾讯云安全团队建议您:
   1)不要打开来历不明的文件或者链接,避免被被攻击者利用在机器上执行恶意代码;
   2)打开Windows Update更新功能,点击“检查更新”,根据业务情况开展评估,下载安装相应的安全补丁;
   3)补丁更新完毕后,重启系统生效,并观察系统及业务运行状态;
   您也可以直接通过微软官方链接进行下载安装,补丁下载地址:
https://portal.msrc.microsoft.com/en-us/security-guidance
  
【备注】建议您在安装补丁前做好数据备份工作,避免出现意外。

【漏洞参考】
  1)官方通告:https://portal.msrc.microsoft.com/en-us/security-guidance
  2)外部分析:https://blog.talosintelligence.com/2018/05/microsoft-patch-tuesday-may-2018.html


2017/5/9


您需要登录后才可以回帖 登录 | 立即注册
您需要登录后才可以发帖 QQ登录

联系我们|腾讯云平台|积分商城|腾讯云官方论坛    

GMT+8, 2018-9-21 01:31 , Processed in 1.170415 second(s), 30 queries .

Powered by Discuz! X2.5

© 2001-2012 Comsenz Inc.

回顶部