2022-11 补丁日: 微软多个漏洞安全更新通告
2022-11-09 15:39

报告编号：B6-2022-110901

报告来源：360CERT

报告作者：360CERT

更新日期：2022-11-09

0x01   漏洞简述

2022年11月08日，微软发布了2022年11月份安全更新，事件等级：严重，事件评分：10.0。

此次安全更新发布了64个漏洞的补丁，主要覆盖了以下组件：Microsoft Windows and Windows Components; Azure and Azure Real Time Operating System; Microsoft Dynamics; Exchange Server; Office and Office Components; SysInternals; Visual Studio; SharePoint Server; Network Policy Server (NPS); Windows BitLocker; Linux Kernel 和Open Source Software等等。其中包含11个严重漏洞，53个高危漏洞。

在此次更新中，微软也修复了影响 Microsoft Exchange Server 2019、2016 和 2013的两个被称为ProxyNotShell的漏洞，发表在 KB5019758 安全更新中，这两个漏洞的CVE编号为：CVE-2022-41040和CVE-2022-41082。

对此，360CERT建议广大用户做好资产自查以及预防工作，以免遭受黑客攻击。

0x02   风险等级

360CERT对该漏洞的评定结果如下

评定方式等级
威胁等级严重
影响面广泛
攻击者价值高
利用难度高
360CERT评分10.0

0x03   漏洞详情

CVE-2022-41091 ：Windows Web 标记 (MOTW) 安全功能绕过漏洞

CVE: CVE-2022-41091

组件: Windows Web 标记 (MOTW) 安全功能

漏洞类型: 安全功能绕过

影响: 安全功能绕过

简述: 该漏洞存在于Windows Web 标记 (MOTW) 安全功能中，是一个安全特性绕过漏洞。攻击者可以制作一个触发漏洞的恶意文件，并通过恶意网站/电子邮件/即时消息进行传递。攻击者可以诱使用户点击恶意链接，向用户发送恶意文件或将用户链接到恶意网站，用户点击恶意链接或者打开恶意文件时能绕过Web查询标记。该漏洞已检测到在野利用。

CVE-2022-41082 ：Microsoft Exchange Server 远程代码执行漏洞

CVE: CVE-2022-41082

组件: Exchange Server

漏洞类型: 代码执行

影响: 服务器接管

简述: 该漏洞存在于Microsoft Exchange Server中，是一个远程代码执行漏洞。经过身份验证的攻击者可利用此漏洞在目标系统上执行任意代码。该漏洞已检测到在野利用。

CVE-2022-41040 ：Microsoft Exchange Server 特权提升漏洞

CVE: CVE-2022-41040

组件: Exchange Server

漏洞类型: 特权提升

影响: 代码执行

简述: 该漏洞存在于Microsoft Exchange Server中，是一个权限提升漏洞。经过身份认证的远程攻击者可利用此漏洞绕过相关安全特性，获得在系统上下文中运行 PowerShell 的权限，在目标系统中执行任意代码。该漏洞已检测到在野利用。

CVE-2022-41128 ：Windows 脚本语言远程代码执行漏洞

CVE: CVE-2022-41128

组件: Windows 脚本语言

漏洞类型: 代码执行

影响: 服务器接管

简述: 该漏洞存在于Windows 脚本语言中，是一个远程代码执行漏洞。要利用此漏洞，攻击者需要引诱用户访问特制网站或服务器，从而在受影响的系统上以登录用户的级别执行任意代码。该漏洞正被广泛利用中。

CVE-2022-41073 ：Windows Print Spooler 特权提升漏洞

CVE: CVE-2022-41073

组件: Windows Print Spooler

漏洞类型: 特权提升

影响: 服务器接管

简述: 该漏洞存在于Windows Print Spooler中，是一个权限提升漏洞。经过身份认证的攻击者可以利用此漏洞将低权限提升至系统级（SYSTEM）权限。该漏洞正被广泛利用中。

CVE-2022-41125 ： Windows CNG 密钥隔离服务特权提升漏洞

CVE: CVE-2022-41125

组件: Windows Cryptography Next Generation (CNG) Key Isolation Service

漏洞类型: 特权提升

影响: 服务器接管

简述: 该漏洞存在于Windows Cryptography Next Generation (CNG) Key Isolation Service 中，是一个特权提升漏洞。经过身份认证的攻击者可以利用此漏洞将权限提升至系统级（SYSTEM）权限。该漏洞已检测到在野利用。

0x04   影响版本

CVE-2022-41091

- Windows Server 2022 Datacenter: Azure Edition (Hotpatch)

- Windows Server 2022 (Server Core installation)

- Windows Server 2022

- Windows Server 2019 (Server Core installation)

- Windows Server 2019

- Windows Server 2016 (Server Core installation)

- Windows Server 2016

- Windows 11 for x64-based Systems

- Windows 11 for ARM64-based Systems

- Windows 11 Version 22H2 for x64-based Systems

- Windows 11 Version 22H2 for ARM64-based Systems

- Windows 10 for x64-based Systems

- Windows 10 for 32-bit Systems

- Windows 10 Version 22H2 for x64-based Systems

- Windows 10 Version 22H2 for ARM64-based Systems

- Windows 10 Version 22H2 for 32-bit Systems

- Windows 10 Version 21H2 for x64-based Systems

- Windows 10 Version 21H2 for ARM64-based Systems

- Windows 10 Version 21H2 for 32-bit Systems

- Windows 10 Version 21H1 for x64-based Systems

- Windows 10 Version 21H1 for ARM64-based Systems

- Windows 10 Version 21H1 for 32-bit Systems

- Windows 10 Version 20H2 for x64-based Systems

- Windows 10 Version 20H2 for ARM64-based Systems

- Windows 10 Version 20H2 for 32-bit Systems

- Windows 10 Version 1809 for x64-based Systems

- Windows 10 Version 1809 for ARM64-based Systems

- Windows 10 Version 1809 for 32-bit Systems

- Windows 10 Version 1607 for x64-based Systems

- Windows 10 Version 1607 for 32-bit Systems

CVE-2022-41082

- Microsoft Exchange Server 2019 Cumulative Update 12

- Microsoft Exchange Server 2019 Cumulative Update 11

- Microsoft Exchange Server 2016 Cumulative Update 23

- Microsoft Exchange Server 2016 Cumulative Update 22

- Microsoft Exchange Server 2013 Cumulative Update 23

CVE-2022-41040

- Microsoft Exchange Server 2019 Cumulative Update 12

- Microsoft Exchange Server 2019 Cumulative Update 11

- Microsoft Exchange Server 2016 Cumulative Update 23

- Microsoft Exchange Server 2016 Cumulative Update 22

- Microsoft Exchange Server 2013 Cumulative Update 23

CVE-2022-41128

- Windows Server 2022

- Windows Server 2019

- Windows Server 2016

- Windows Server 2012 R2

- Windows Server 2012

- Windows Server 2008 R2 for x64-based Systems Service Pack 1

- Windows RT 8.1

- Windows 8.1 for x64-based systems

- Windows 8.1 for 32-bit systems

- Windows 7 for x64-based Systems Service Pack 1

- Windows 7 for 32-bit Systems Service Pack 1

- Windows 11 for x64-based Systems

- Windows 11 for ARM64-based Systems

- Windows 11 Version 22H2 for x64-based Systems

- Windows 11 Version 22H2 for ARM64-based Systems

- Windows 10 for x64-based Systems

- Windows 10 for 32-bit Systems

- Windows 10 Version 22H2 for x64-based Systems

- Windows 10 Version 22H2 for ARM64-based Systems

- Windows 10 Version 22H2 for 32-bit Systems

- Windows 10 Version 21H2 for x64-based Systems

- Windows 10 Version 21H2 for ARM64-based Systems

- Windows 10 Version 21H2 for 32-bit Systems

- Windows 10 Version 21H1 for x64-based Systems

- Windows 10 Version 21H1 for ARM64-based Systems

- Windows 10 Version 21H1 for 32-bit Systems

- Windows 10 Version 20H2 for x64-based Systems

- Windows 10 Version 20H2 for ARM64-based Systems

- Windows 10 Version 20H2 for 32-bit Systems

- Windows 10 Version 1809 for x64-based Systems

- Windows 10 Version 1809 for ARM64-based Systems

- Windows 10 Version 1809 for 32-bit Systems

- Windows 10 Version 1607 for x64-based Systems

- Windows 10 Version 1607 for 32-bit Systems

CVE-2022-41073

- Windows Server 2022 Datacenter: Azure Edition (Hotpatch)

- Windows Server 2022 (Server Core installation)

- Windows Server 2022

- Windows Server 2019 (Server Core installation)

- Windows Server 2019

- Windows Server 2016 (Server Core installation)

- Windows Server 2016

- Windows Server 2012 R2 (Server Core installation)

- Windows Server 2012 R2

- Windows Server 2012 (Server Core installation)

- Windows Server 2012

- Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

- Windows Server 2008 for x64-based Systems Service Pack 2

- Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

- Windows Server 2008 for 32-bit Systems Service Pack 2

- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

- Windows Server 2008 R2 for x64-based Systems Service Pack 1

- Windows RT 8.1

- Windows 8.1 for x64-based systems

- Windows 8.1 for 32-bit systems

- Windows 7 for x64-based Systems Service Pack 1

- Windows 7 for 32-bit Systems Service Pack 1

- Windows 11 for x64-based Systems

- Windows 11 for ARM64-based Systems

- Windows 11 Version 22H2 for x64-based Systems

- Windows 11 Version 22H2 for ARM64-based Systems

- Windows 10 for x64-based Systems

- Windows 10 for 32-bit Systems

- Windows 10 Version 22H2 for x64-based Systems

- Windows 10 Version 22H2 for ARM64-based Systems

- Windows 10 Version 22H2 for 32-bit Systems

- Windows 10 Version 21H2 for x64-based Systems

- Windows 10 Version 21H2 for ARM64-based Systems

- Windows 10 Version 21H2 for 32-bit Systems

- Windows 10 Version 21H1 for x64-based Systems

- Windows 10 Version 21H1 for ARM64-based Systems

- Windows 10 Version 21H1 for 32-bit Systems

- Windows 10 Version 20H2 for x64-based Systems

- Windows 10 Version 20H2 for ARM64-based Systems

- Windows 10 Version 20H2 for 32-bit Systems

- Windows 10 Version 1809 for x64-based Systems

- Windows 10 Version 1809 for ARM64-based Systems

- Windows 10 Version 1809 for 32-bit Systems

- Windows 10 Version 1607 for x64-based Systems

- Windows 10 Version 1607 for 32-bit Systems

CVE-2022-41125

- Windows Server 2022 Datacenter: Azure Edition (Hotpatch)

- Windows Server 2022 (Server Core installation)

- Windows Server 2022

- Windows Server 2019 (Server Core installation)

- Windows Server 2019

- Windows Server 2016 (Server Core installation)

- Windows Server 2016

- Windows Server 2012 R2 (Server Core installation)

- Windows Server 2012 R2

- Windows Server 2012 (Server Core installation)

- Windows Server 2012

- Windows RT 8.1

- Windows 8.1 for x64-based systems

- Windows 8.1 for 32-bit systems

- Windows 11 for x64-based Systems

- Windows 11 for ARM64-based Systems

- Windows 11 Version 22H2 for x64-based Systems

- Windows 11 Version 22H2 for ARM64-based Systems

- Windows 10 for x64-based Systems

- Windows 10 for 32-bit Systems

- Windows 10 Version 22H2 for x64-based Systems

- Windows 10 Version 22H2 for ARM64-based Systems

- Windows 10 Version 22H2 for 32-bit Systems

- Windows 10 Version 21H2 for x64-based Systems

- Windows 10 Version 21H2 for ARM64-based Systems

- Windows 10 Version 21H2 for 32-bit Systems

- Windows 10 Version 21H1 for x64-based Systems

- Windows 10 Version 21H1 for ARM64-based Systems

- Windows 10 Version 21H1 for 32-bit Systems

- Windows 10 Version 20H2 for x64-based Systems

- Windows 10 Version 20H2 for ARM64-based Systems

- Windows 10 Version 20H2 for 32-bit Systems

- Windows 10 Version 1809 for x64-based Systems

- Windows 10 Version 1809 for ARM64-based Systems

- Windows 10 Version 1809 for 32-bit Systems

- Windows 10 Version 1607 for x64-based Systems

- Windows 10 Version 1607 for 32-bit Systems

0x05   修复建议

通用修补建议

360CERT建议通过安装360安全卫士进行一键更新。

应及时进行Microsoft Windows版本更新并且保持Windows自动更新开启。

Windows server / Windows 检测并开启Windows自动更新流程如下：

- 点击开始菜单，在弹出的菜单中选择“控制面板”进行下一步。

- 点击控制面板页面中的“系统和安全”，进入设置。

- 在弹出的新的界面中选择“windows update”中的“启用或禁用自动更新”。

- 然后进入设置窗口，展开下拉菜单项，选择其中的自动安装更新（推荐）。

临时修补建议

通过如下链接寻找符合操作系统版本的漏洞补丁，并进行补丁下载安装。

Oct 2022 Security Updates

0x06   产品侧解决方案

若想了解更多产品信息或有相关业务需求，可移步至http://360.net。

360企业安全云

用户可以通过安装360安全卫士并进行全盘杀毒来维护计算机安全。360CERT建议广大用户使用360安全卫士定期对设备进行安全检测，以做好资产自查以及防护工作。

360威胁情报平台（TIP）

360威胁情报平台（TIP）一款构建全面情报管理、赋能、评价、分享能力的新一代本地化情报平台。可以用来增强对关键威胁的检测；可以自动化识别报警中的重点事件；还可以提供情报分析、外部攻击面管理、行业威胁情报等高阶能力，帮助组织全面应对数字时代的安全风险。

360安全分析响应平台

360安全大脑的安全分析响应平台通过网络流量检测、多传感器数据融合关联分析手段，对该类漏洞的利用进行实时检测和阻断，请用户联系相关产品区域负责人获取对应产品。

360安全卫士

Windows用户可通过360安全卫士实现对应补丁安装、漏洞修复、恶意软件查杀，其他平台的用户可以根据修复建议列表中的安全建议进行安全维护。

360CERT建议广大用户使用360安全卫士定期对设备进行安全检测，以做好资产自查以及防护工作。

0x07   时间线

2022-11-08 微软官方发布通告

2022-11-09 360CERT发布通告

0x08   参考链接

1、 https://msrc.microsoft.com/update-guide/releaseNote/2022-Nov