九游老哥云
【清静通告】微软9月清静更新多个产品高危误差通告
2020-09-09
一. 误差概述
北京时间9月9日，微软宣布9月清静更新补丁，修复了129个清静问题，涉及Microsoft Windows、Internet Explorer、Microsoft Office、Microsoft Exchange Server、Visual Studio、ASP.NET等普遍使用的产品，其中包括远程代码执行和权限提升等高危误差类型。
本月微软月度更新修复的误差中，严重水平为要害（Critical）的误差共有23个，主要（Important）误差有105个。请相关用户实时更新补丁举行防护，详细误差列表请参考附录。
参考链接：
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Sep
二. 重点误差简述
凭证产品盛行度和误差主要性筛选出此次更新中包括影响较大的误差，请相关用户重点举行关注：
CVE-2020-16875: Exchange Server 远程代码执行误差
Microsoft Exchange在Internet Explorer中处置惩罚内存中的工具时，保存远程代码执行误差。使用此误差需要拥有以某个Exchange角色举行身份验证的用户权限，攻击者可通过向受影响的Exchange服务器发送包括特殊的cmdlet参数的邮件来触发此误差，乐成使用此误差的攻击者可在受影响的系统上以system权限执行恣意代码。
官方通告链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875
CVE-2020-1129/CVE-2020-1319：Microsoft Windows Codecs Library远程代码执行误差
Microsoft Windows Codecs Library在处置惩罚内存中的工具时保存远程代码执行误差（CVE-2020-1129）。攻击者可通过诱导用户翻开特制图像文件来使用此误差，乐成使用此误差的攻击者可获守信息从而进一步入侵受影响的系统。
Microsoft Windows Codecs Library在处置惩罚内存中的工具时保存远程代码执行误差（CVE-2020-1319）。攻击者通过结构特制的文件并诱使用户翻开来使用此误差，乐成使用此误差的攻击者可控制受影响的系统。
官方通告链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1129
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1319
CVE-2020-0922: Microsoft COM 远程代码执行误差
Microsoft COM for Windows在处置惩罚内存中的工具时，保存远程代码执行误差。攻击者可通过诱导用户翻开特制文件或诱导用户会见具有恶意JavaScript的网站来使用此误差，乐成使用此误差的攻击者可在受影响的系统上执行恣意代码。
官方通告链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0922
CVE-2020-1252：Windows远程代码执行误差
Windows在处置惩罚内存中的工具时，保存远程代码执行误差。攻击者通过在目的系统运行特制的应用程序来使用此误差，乐成使用此误差的攻击者可执行恣意代码控制受影响的系统。
官方通告链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1252
CVE-2020-1285：GDI+ 远程代码执行误差
Windows Graphics Device Interface (GDI) 在处置惩罚内存中的工具时保存远程代码执行误差。攻击者可通过诱导用户翻开特殊设计的恶意网站，如点击电子邮件或即时新闻中的链接来使用此误差，攻击者还可通过向用户发送特制文档文件并诱导用户翻开来使用此误差，乐成使用此误差的攻击者可在目的系统上以目今用户权限执行恣意代码。
官方通告链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1285
SharePoint 多个远程执行代码误差
（CVE-2020-1200、CVE-2020-1210、CVE-2020-1452、CVE-2020-1453、CVE-2020-1460、CVE-2020-1576、CVE-2020-1595）
Microsoft SharePoint在检查应用程序包的源标记时，保存5个远程代码执行误差（CVE-2020-1200、CVE-2020-1210、CVE-2020-1452、CVE-2020-1453、CVE-2020-1576）。攻击者可通过向受影响的SharePoint上传特制SharePoint应用程序包来使用此误差，乐成使用此误差的攻击者可在 SharePoint应用程序池和SharePoint服务器账户的上下文中执行恣意代码。
Microsoft SharePoint Server 无法准确识别和筛选不清静的 ASP.NET Web 控件时，保存远程代码执行误差（CVE-2020-1460）。经由身份验证的攻击者可通过在受影响的Microsoft SharePoint 服务器上建设并挪用特制页面来使用此误差，乐成使用此误差的攻击者可使用特制页面在SharePoint应用程序池历程的上下文中执行恣意代码。
Microsoft SharePoint某些API在处置惩罚不清静的数据输入时，保存远程代码执行误差（CVE-2020-1595）。攻击者可通过使用特命名堂的输入会见受影响版本SharePoint 上易受攻击的 API来使用此误差，乐成使用此误差的攻击者可在目的 SharePoint应用程序池和SharePoint服务器账户的上下文中执行恣意代码。
官方通告链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1200
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1210
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1452
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1453
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1460
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1576
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1595
三. 影响规模
以下为重点关注误差的受影响产品版本，其他误差影响产品规模请参阅官方通告链接。
|
误差编号 |
受影响产品版本 |
|
CVE-2020-16875 |
Microsoft Exchange Server 2016 Cumulative Update 16 Microsoft Exchange Server 2016 Cumulative Update 17 Microsoft Exchange Server 2019 Cumulative Update 5 Microsoft Exchange Server 2019 Cumulative Update 6 |
|
CVE-2020-1129 |
Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1709 for ARM64-based Systems Windows 10 Version 1709 for x64-based Systems Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for x64-based Systems Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server, version 2004 (Server Core installation) |
|
CVE-2020-1319 |
Windows 10 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1709 for ARM64-based Systems Windows 10 Version 1709 for x64-based Systems Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for x64-based Systems Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server, version 2004 (Server Core installation) |
|
CVE-2020-0922 CVE-2020-1252 CVE-2020-1285 |
Windows 10 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1709 for ARM64-based Systems Windows 10 Version 1709 for x64-based Systems Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for x64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows 8.1 for 32-bit systems Windows 8.1 for x64-based systems Windows RT 8.1 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server, version 2004 (Server Core installation) |
|
CVE-2020-1200 |
Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2010 Service Pack 2 Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server 2019 |
|
CVE-2020-1210 |
Microsoft Business Productivity Servers 2010 Service Pack 2 Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server 2010 Service Pack 2 Microsoft SharePoint Server 2019 |
|
CVE-2020-1452 CVE-2020-1453 CVE-2020-1460 |
Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2010 Service Pack 2 Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server 2019 |
|
CVE-2020-1595 |
Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server 2019 |
|
CVE-2020-1576 |
Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2010 Service Pack 2 Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server 2010 Service Pack 2 Microsoft SharePoint Server 2019 |
四. 误差防护
4.1 补丁更新
现在微软官方已针对受支持的产品版本宣布了修复以上误差的清静补丁，强烈建议受影响用户尽快装置补丁举行防护，官方下载链接：
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Sep
注：由于网络问题、盘算机情形问题等缘故原由，Windows Update的补丁更新可能泛起失败。用户在装置补丁后，应实时检查补丁是否乐成更新。
右键点击Windows图标，选择“设置(N)”，选择“更新和清静”-“Windows更新”，审查该页面上的提醒信息，也可点击“审查更新历史纪录”审查历史更新情形。
针对未乐成装置的更新，可点击更新名称跳转到微软官方下载页面，建议用户点击该页面上的链接，转到“Microsoft更新目录”网站下载自力程序包并装置。
声明
本清静通告仅用来形貌可能保存的清静问题，九游老哥科技不为此清静通告提供任何包管或允许。由于撒播、使用此清静通告所提供的信息而造成的任何直接或者间接的效果及损失，均由使用者自己认真，九游老哥科技以及清静通告作者不为此肩负任何责任。
九游老哥科技拥有对此清静通告的修改息争释权。如欲转载或撒播此清静通告，必需包管此清静通告的完整性，包括版权声明等所有内容。未经九游老哥科技允许，不得恣意修改或者增减此清静通告内容，不得以任何方法将其用于商业目的。
关于九游老哥科技
九游老哥（简称九游老哥科技）建设于2000年4月，总部位于北京。在海内外设有40个分支机构，为政府、运营商、金融、能源、互联网以及教育、医疗等行业用户，提供具有焦点竞争力的清静产品及解决计划，资助客户实现营业的清静顺畅运行。
基于多年的清静攻防研究，九游老哥科技在网络及终端清静、互联网基础清静、合规及清静治理等领域，为客户提供入侵检测/防护、抗拒绝服务攻击、远程清静评估以及Web清静防护等产品以及专业清静服务。
九游老哥于2014年1月29日起在深圳证券生意所创业板上市，股票简称：九游老哥科技，股票代码：300369。
