CNNVD通報(bào)Microsoft Windows Support Diagnostic Tool安全漏洞

發(fā)布時(shí)間 2022-06-10

1.jpg

日前，國家信息安全漏洞庫（CNNVD）正式發(fā)布了關(guān)于Microsoft Windows Support Diagnostic Tool安全漏洞（CNNVD-202205-4277、CVE-2022-30190）的情況通報(bào)。成功利用此漏洞的攻擊者，可在目標(biāo)主機(jī)執(zhí)行惡意代碼。Windows 11、Windows 10 、Windows 8、Windows 7、Windows Server 2022、Windows Server 2016、Windows Server 2012、Windows Server 2008、Windows Server version 20H2、Windows Server 2022等多個(gè)系統(tǒng)版本均受此漏洞影響。目前，微軟官方發(fā)布了臨時(shí)修補(bǔ)措施緩解漏洞帶來的危害，請用戶及時(shí)確認(rèn)是否受到漏洞影響，盡快采取修補(bǔ)措施。

1、漏洞介紹

Microsoft Windows Support Diagnostic Tool是美國微軟公司W(wǎng)indows操作系統(tǒng)內(nèi)的一個(gè)程序，用于排除故障并收集診斷數(shù)據(jù)以供技術(shù)人員分析和解決問題。該漏洞源于Microsoft Windows Support Diagnostic Tool中的URL協(xié)議存在邏輯問題，攻擊者可誘使目標(biāo)主機(jī)的應(yīng)用（如word）通過Microsoft Windows Support Diagnostic Tool中的URL協(xié)議下載并打開特制的文件，進(jìn)而在目標(biāo)主機(jī)執(zhí)行惡意代碼。

2、危害影響

成功利用此漏洞的攻擊者，可在目標(biāo)主機(jī)執(zhí)行惡意代碼。以下操作系統(tǒng)版本受漏洞影響：

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems

Windows 7 for x64-based Systems Service Pack 1

Windows 7 for 32-bit Systems Service Pack 1

Windows Server 2016  (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 Azure Edition Core Hotpatch

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019  (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit  Systems    

3、修復(fù)建議

目前，微軟官方發(fā)布了臨時(shí)修補(bǔ)措施緩解漏洞帶來的危害，請用戶及時(shí)確認(rèn)是否受到漏洞影響，盡快采取修補(bǔ)措施。官方鏈接如下：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190