股票代码：688225
打开微信“扫一扫”，开启安全数字世界之旅
截图或长按保存至相册，使用微信扫一扫
【修补方案】Windows打印后台处理程序曝高危漏洞
发布时间 ：2021年06月30日
类型 ：勒索软件
分享：
漏洞描述
近日，威尼斯432888camCERT监测到Github上有安全研究人员发布了Windows Print Spooler远程代码执行漏洞（编号：CVE-2021-1675）的EXP和漏洞详情分析，漏洞等级高危，CVSS评分7.8。该漏洞已于2021年6月8日由微软发布相关通告，并在6月9日推送的安全更新补丁中修复了该漏洞。
Windows Print Spooler是打印后台处理服务，负责与打印相关的事务。该服务被发现存在权限提升漏洞，经过身份认证的攻击者可利用此漏洞加载恶意DLL执行以获取权限。通常情况，客户端可以在经过身份验证的条件下，通过调用RpcAddPrinterDriver可以向打印服务添加驱动程序，但由于Spooler Service的常规安全检查中与身份验证相关的参数可控，导致普通用户可以绕过安全检查并添加驱动程序。在域中，普通域用户可以连接到 域控制器（DC）中的Spooler服务并在 域控制器（DC）中安装驱动程序。从而完全控制整个域。
鉴于，该漏洞危害较大，建议尽快安装补丁，或临时禁用Print Spooler服务。
漏洞编号
CVE-2021-1675
漏洞等级
高危，CVSS评分 7.8
漏洞修复
下载官方发布的安全补丁
目前微软官方已针对支持的系统版本发布了修复该漏洞的安全补丁，补丁地址：https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
临时修复建议
禁用Print Spooler服务
受影响的版本
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server, version 2004 (Server Core installation)
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
参考链接：
1.https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
2.https://github.com/afwu/PrintNightmare
3.https://twitter.com/RedDrip7/status/1409353110187757575
分享到微信
X