描述:
Microsoft 发布了安全性更新以应对数个影响 Microsoft 产品或元件的多个漏洞。有关安全性更新的列表，请参考以下网址：
https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jul
有报告指在 Microsoft Windows 及 Server 的多个漏洞 (CVE-2021-34527、CVE-2021-34448、CVE-2021-33771 及 CVE-2021-31979) 正受到攻击。系统管理员应立即为受影响的系统安装修补程式，以减低受到网络攻击的风险。
受影响的系统:
- Microsoft Windows 7, 8.1, RT 8.1, 10
- Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019
- Microsoft Windows Server, version 1909, version 2004, version 20H2
- Microsoft Office 2013, 2013 RT, 2016, 2019, 2019 for Mac
- Microsoft Office Online Server
- Microsoft Office Web Apps Server 2013
- Microsoft Excel 2013, 2013 RT, 2016
- Microsoft Word 2016
- Microsoft 365 Apps for Enterprise
- Microsoft Exchange Server 2013, 2016, 2019
- Microsoft SharePoint Foundation 2013
- Microsoft SharePoint Enterprise Server 2013, 2016
- Microsoft SharePoint Server 2019
- .NET Education Bundle SDK Install Tool, Install Tool for Extension Authors
- HEVC Video Extensions
- Microsoft Dynamics 365 Business Central 2020, 2021
- Microsoft Bing Search for Android
- Microsoft Malware Protection Engine
- Open Enclave SDK
- Power BI Report Server
- Visual Studio Code
影响:
成功利用这些漏洞可以导致远端执行程式码、权限提升、泄漏资讯、服务受阻断、绕过保安功能、仿冒诈骗及深度防御，视乎攻击者利用哪个漏洞而定。
建议:
受影响产品的修补程式可在 Windows Update 或 Microsoft Update Catalog 获取。受影响系统的用户应遵从产品供应商的建议，立即采取行动以降低风险。
进一步信息:
- https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jul
- https://www.hkcert.org/tc/security-bulletin/microsoft-monthly-security-update-july-2021
- https://us-cert.cisa.gov/ncas/current-activity/2021/07/13/microsoft-releases-july-2021-security-updates
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31183
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31196
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31206
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31947
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31961
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31979
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31984
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33740
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33743 (to CVE-2021-33746)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33749 (to CVE-2021-33761)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33763 (to CVE-2021-33768)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33771 (to CVE-2021-33786)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34438 (to CVE-2021-34442)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34444 (to CVE-2021-34452)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34454 (to CVE-2021-34462)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34464
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34466 (to CVE-2021-34470)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34473
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34474
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34476
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34477
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34479
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34488 (to CVE-2021-34494)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34496 (to CVE-2021-34501)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34503
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34504
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34507 (to CVE-2021-34514)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34516 (to CVE-2021-34523)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34525
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34528
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34529