描述:
Microsoft 發布了安全性更新以應對數個影響 Microsoft 產品或元件的多個漏洞。有關安全性更新的列表，請參考以下網址：
https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jul
有報告指在 Microsoft Windows 及 Server 的多個漏洞 (CVE-2021-34527、CVE-2021-34448、CVE-2021-33771 及 CVE-2021-31979) 正受到攻擊。系統管理員應立即為受影響的系統安裝修補程式，以減低受到網絡攻擊的風險。
受影響的系統:
- Microsoft Windows 7, 8.1, RT 8.1, 10
- Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019
- Microsoft Windows Server, version 1909, version 2004, version 20H2
- Microsoft Office 2013, 2013 RT, 2016, 2019, 2019 for Mac
- Microsoft Office Online Server
- Microsoft Office Web Apps Server 2013
- Microsoft Excel 2013, 2013 RT, 2016
- Microsoft Word 2016
- Microsoft 365 Apps for Enterprise
- Microsoft Exchange Server 2013, 2016, 2019
- Microsoft SharePoint Foundation 2013
- Microsoft SharePoint Enterprise Server 2013, 2016
- Microsoft SharePoint Server 2019
- .NET Education Bundle SDK Install Tool, Install Tool for Extension Authors
- HEVC Video Extensions
- Microsoft Dynamics 365 Business Central 2020, 2021
- Microsoft Bing Search for Android
- Microsoft Malware Protection Engine
- Open Enclave SDK
- Power BI Report Server
- Visual Studio Code
影響:
成功利用這些漏洞可以導致遠端執行程式碼、權限提升、泄漏資訊、服務受阻斷、繞過保安功能、仿冒詐騙及深度防禦，視乎攻擊者利用哪個漏洞而定。
建議:
受影響產品的修補程式可在 Windows Update 或 Microsoft Update Catalog 獲取。受影響系統的用戶應遵從產品供應商的建議，立即採取行動以降低風險。
進一步資訊:
- https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Jul
- https://www.hkcert.org/tc/security-bulletin/microsoft-monthly-security-update-july-2021
- https://us-cert.cisa.gov/ncas/current-activity/2021/07/13/microsoft-releases-july-2021-security-updates
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31183
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31196
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31206
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31947
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31961
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31979
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31984
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33740
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33743 (to CVE-2021-33746)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33749 (to CVE-2021-33761)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33763 (to CVE-2021-33768)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33771 (to CVE-2021-33786)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34438 (to CVE-2021-34442)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34444 (to CVE-2021-34452)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34454 (to CVE-2021-34462)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34464
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34466 (to CVE-2021-34470)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34473
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34474
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34476
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34477
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34479
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34488 (to CVE-2021-34494)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34496 (to CVE-2021-34501)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34503
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34504
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34507 (to CVE-2021-34514)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34516 (to CVE-2021-34523)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34525
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34528
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34529