一、漏洞概要
2024年1月10日（北京时间），微软发布了安全更新，共发布了53个CVE的补丁程序，同比上月增多了11个。在漏洞安全等级方面，存在2个标记等级为“Critical”的漏洞，51个漏洞被标记为“Important/High”等级的漏洞；在漏洞类型方面，主要有16个远程代码执行漏洞，10个权限提升漏洞以及11个信息泄露漏洞。
二、漏洞分析
Windows Hyper-V远程执行代码漏洞CVE-2024-20700 Hyper-V，代号Viridian，旧称Windows Server Virtualization，是Microsoft的本地虚拟机管理程序，它可以在运行x86-64位的Windows上创建虚拟机。 其中存在远程执行代码漏洞，攻击者可以利用该漏洞在目标系统执行任意代码。经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
Windows Kerberos安全功能绕过漏洞CVE-2024-20674
Kerberos是一种计算机网络授权协议，用来在非安全网络中，对个人通信以安全的手段进行身份认证。其中存在安全功能绕过漏洞，攻击者可以利用该漏洞在绕过目标系统上的安全功能，做出规定之外的行为。经过评估，危害比较大，我们建议用户及时更新微软安全补丁。
三、影响范围
漏洞名称、CVE编号 |
受影响版本 |
Windows Hyper-V远 程 执 行 代 码 漏 洞CVE-2024-20700 |
Windows Server 2022, 23H2 Edition (Server Coreinstallation) Windows 11 Version 23H2 for x64-based Systems Windows 11 Version 23H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for x64-based Systems |
Windows Kerberos安全 功 能 绕 过 漏 洞CVE-2024-20674 |
Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 22H2 for ARM64-based Systems Windows 10 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 22H2 for ARM64-based Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 version 21H2 for ARM64-based Systems Windows 11 version 21H2 for x64-based Systems Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2022, 23H2 Edition (Server Coreinstallation) Windows 11 Version 23H2 for x64-based Systems Windows 11 Version 23H2 for ARM64-based Systems Windows 10 Version 22H2 for 32-bit Systems Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 R2 for x64-based Systems ServicePack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems ServicePack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems ServicePack 1 Windows Server 2008 R2 for x64-based Systems ServicePack 1 Windows Server 2008 for x64-based Systems ServicePack 2 (Server Core installation) Windows Server 2008 for x64-based Systems ServicePack 2 (Server Core installation) Windows Server 2008 for x64-based Systems ServicePack 2 Windows Server 2008 for x64-based Systems ServicePack 2 Windows Server 2008 for 32-bit Systems Service Pack2(Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack2(Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack2Windows Server 2008 for 32-bit Systems Service Pack2Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems 10 Windows 10 for x64-based Systems Windows 10 for 32-bit Systems |
四、解决方案
微软官方已更新受影响软件的安全补丁，用户可根据不同系统版本下载安装对应的安全补丁，安全更新链接如下：
