企业新(xīn)闻—关于我们—亚信安(ān)全—护航产(chǎn)业互联安(ān)全数字世界

漏洞描述

近日，亚信安(ān)全CERT监测到Github上有(yǒu)安(ān)全研究人员发布了Windows Print Spooler遠(yuǎn)程代码执行漏洞（编号：CVE-2021-1675）的EXP和漏洞详情分(fēn)析，漏洞等级高危，CVSS评分(fēn)7.8。该漏洞已于2021年6月8日由微软发布相关通告，并在6月9日推送的安(ān)全更新(xīn)补丁中(zhōng)修复了该漏洞。

Windows Print Spooler是打印后台处理(lǐ)服務(wù)，负责与打印相关的事務(wù)。该服務(wù)被发现存在权限提升漏洞，经过身份认证的攻击者可(kě)利用(yòng)此漏洞加载恶意DLL执行以获取权限。通常情况，客户端可(kě)以在经过身份验证的条件下，通过调用(yòng)RpcAddPrinterDriver可(kě)以向打印服務(wù)添加驱动程序，但由于Spooler Service的常规安(ān)全检查中(zhōng)与身份验证相关的参数可(kě)控，导致普通用(yòng)户可(kě)以绕过安(ān)全检查并添加驱动程序。在域中(zhōng)，普通域用(yòng)户可(kě)以连接到域控制器（DC）中(zhōng)的Spooler服務(wù)并在域控制器（DC）中(zhōng)安(ān)装(zhuāng)驱动程序。从而完全控制整个域。

鉴于，该漏洞危害较大，建议尽快安(ān)装(zhuāng)补丁，或临时禁用(yòng)Print Spooler服務(wù)。

漏洞编号

CVE-2021-1675

漏洞等级

高危，CVSS评分(fēn) 7.8

漏洞修复

下载官方发布的安(ān)全补丁
目前微软官方已针对支持的系统版本发布了修复该漏洞的安(ān)全补丁，补丁地址：https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
临时修复建议
禁用(yòng)Print Spooler服務(wù)

受影响的版本

Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server, version 2004 (Server Core installation)
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

参考链接：

1.https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675

2.https://github.com/afwu/PrintNightmare

3.https://twitter.com/RedDrip7/status/1409353110187757575

产(chǎn)品全景图 >

安(ān)全服務(wù) >

安(ān)全运营 >

首页(yè)

产(chǎn)品与服務(wù)

云安(ān)全

终端安(ān)全

数据安(ān)全

身份安(ān)全

高级威胁治理(lǐ)

网络与通信安(ān)全

安(ān)全管理(lǐ)

SaaS服務(wù)

一體(tǐ)化智能(néng)安(ān)全运营平台

网络管理(lǐ)

信息技(jì )术应用(yòng)创新(xīn)

工(gōng)业安(ān)全

解决方案与案例

客户支持

合作(zuò)共赢

安(ān)全通告

C3安(ān)全大会

投资者关系

关于我们

新(xīn)闻与活动

亚信安(ān)全最新(xīn)资讯与活动。