补丁星期二- 2024年4月

最后更新于2024年4月12日(星期五)20:45:39 GMT

微软正在解决149个漏洞 2024年4月补丁星期二这比平时要多得多. 已经连续两个月了, 微软 indicated that they weren't aware of prior public disclosure or exploitation in the wild for any of the vulnerabilities patched today. 然而，当天晚些时候，微软随后更新了这一建议 cve - 2024 - 26234 承认野蛮的利用和公开披露的利用. 在撰写本文时，CISA KEV没有新增内容.

尽管今天发布了大量的漏洞, 微软在其专有的严重程度等级中，仅将三个列为严重级别. Five browser vulnerabilities were published separately this month, 和 are not included in the total.

微软现在在咨询中加入了两个额外的数据点: 常见弱点列举(CWE) 和矢量字符串源评估.

Windows代理驱动程序:最新的零日欺骗漏洞

最初发布时，该建议为 cve - 2024 - 26234 did not indicate that 微软 was aware of in-the-wild exploitation or public exploit disclosure. 然而, 在出版当天晚些时候, 微软 updated the advisory to acknowledge awareness of both in-the-wild exploitation 和 public disclosure.

该报告几乎没有提供有关漏洞本身性质的细节, 除了基本事实之外:这是一个代理欺骗漏洞, 支持的Windows版本提供了补丁.

物联网防御者:三个关键的rce

微软 Defender for IoT receives patches for three critical remote code execution (RCE) vulnerabilities. 微软 描述了 Defender for IoT as an Azure-deployable agentless monitoring solution for Internet of Things (IoT) 和 Operational Technology (OT) devices.

建议: cve - 2024 - 21322 是对细节的轻视, but notes that exploitation requires the attacker to have existing administrative access to the Defender for IoT web application; this lim它的 the attacker value in isolation, although the potential for insider threat or use as part of an exploit chain remains.

cve - 2024 - 21323 描述了 an update-based attack 和 requires prior authentication; an attacker with the ability to control how a Defender for IoT sensor receives updates could cause the sensor device to 应用 a malicious update package, overwriting arbitrary files on the sensor filesystem via a path traversal weakness.

开发 cve - 2024 - 29053 允许任何经过身份验证的用户上传任意文件, 也是通过路径穿越的弱点, although the advisory does not specify what the target is other than “the server”.

的 IoT 24的防御者.1.3版本说明 do not call out these security fixes 和 describe only improvements to clock drift detection 和 unspecified stability improvements; this omission highlights the evergreen value of timely patching.

XSS欺骗

SharePoint收到一个补丁 cve - 2024 - 26251, a spoofing vulnerability which abuses cross-site scripting (XSS) 和 affects SharePoint Server 2016, 2019, 及订阅版. 开发需要满足多个条件, 包括但不限于对用户行为的依赖, 令牌的模拟, 以及特定的应用程序配置. 在此基础上, 尽管微软拥有成熟的漏洞利用代码, 被认为不太可能被剥削.

Excel:任意文件执行

微软今天修补了Office的一个漏洞. cve - 2024 - 26257 描述了 a RCE vulnerability in Excel; exploitation requires that the attacker convinces the user to open a specially-crafted malicious file.

基于windows的补丁 点击运行(C2R)办公室部署 微软365企业版应用程序立即可用. 不是第一次了, 在撰写本文时，Mac版Office还没有补丁, 并将在未来的某个时间点跟进.

SQL Server OLE DB驱动:几十个RCE

的 微软 OLE DB Driver for SQL Server receives patches for no fewer than 38 separate RCE vulnerabilities today, 哪个可能是单个组件的记录. 的 common theme here is that an attacker could trick a user into connecting to a malicious SQL server to achieve code execution in the context of the client.

交易所那边鸦雀无声

本月没有针对Exchange的安全补丁.

微软咨询元数据:CWE和矢量字符串源

的 增加CWE评估 to 微软 security advisories helps pinpoint the generic root cause of a vulnerability; e.g., cve - 2024 - 21322 is assigned “CWE-77: Improper Neutralization of Special Elements used in a Comm和 ('Comm和 Injection').“通过采用CWE分类法, 微软正在放弃自己的专有系统来描述根本原因. 的 CWE程序 有 最近更新的 它的 将cve映射到CWE根本原因的指南.

Analysis of CWE trends can help developers reduce future occurrences through improved Software Development Life Cycle (SDLC) workflows 和 testing, as well as helping defenders underst和 where to direct defense-in-depth 和 deployment-hardening efforts for best return on investment. At time of writing, the 增加CWE评估 does not appear to be retroactive.

的 Common 脆弱性 Scoring System (CVSS) is a widely-used st和ard for evaluation of vulnerability severity, 和 微软 有 helpfully provided CVSS data for each vulnerability for a long time. 的 CVSS vector 描述了 the variables which comprise the overall CVSS severity score for a vulnerability. 添加向量字符串源-通常, the entity providing the CVSS assessment on a 微软 vulnerability will be 微软 — provides further welcome clarity, 至少对于微软是CVE编号机构(CNA)的漏洞. It may not be a coincidence that 微软 is choosing to start explicitly describing the source of the CVSS vector during the 围绕NVD项目未来的不确定性.

生命周期更新

今天之后，一些微软产品将不再获得主流支持:

• Azure DevOps服务器2019.
• 系统中心2019.
• Visual Studio 2019.

Additionally, some older products move past the end of extended support, including:

• 微软部署代理2013.
• 微软诊断和恢复工具集.1.
• Visual Studio 2013.

总结图表

汇总表

Azure的漏洞

浏览器的漏洞

开发人员工具漏洞

静电单位漏洞

微软 Office漏洞

其他漏洞

SQL Server漏洞

SQL Server开发人员工具漏洞

System Center漏洞

Windows操作系统漏洞

Windows ESU漏洞

更新

• 2024-04-09: Updated discussion of vuln diclosure prior to publication to reflect 微软's update to the advisory for cve - 2024 - 26234.