【漏洞情报】微软2019年06月补丁情报

【漏洞详情】

微软已发布2019年06月安全补丁,修复了93个安全漏洞,其中critical漏洞22个,涉及Windows Authentication Methods、Adobe Flash Player、Microsoft Edge等产品组件,特别是NTLM 协议安全漏洞(CVE-2019-1040),该漏洞能使攻击者在仅有一个普通域账号的情况下,远程控制Windows 域内的任何终端设备,包括域控服务器,修复的漏洞详细列表如下,请用户依据自身业务评估实际漏洞影响及时安排补丁升级,以提高系统安全性:

序号

产品

CVE 编号

CVE 标题

严重程度

1

Adobe Flash Player

ADV190015

June 2019 Adobe Flash 安全更新

Critical

2

Kerberos

CVE-2019-0972

Local Security Authority Subsystem Service 拒绝服务漏洞

Important

3

Microsoft Browsers

CVE-2019-1038

Microsoft Browser 内存破坏漏洞

Critical

4

Microsoft Browsers

CVE-2019-1081

Microsoft Browser 信息泄露漏洞

Important

5

Microsoft Devices

ADV190016

Bluetooth Low Energy Advisory

Important

6

Microsoft Devices

ADV190017

Microsoft HoloLens Remote Code Execution Vulnerabilities

Important

7

Microsoft Edge

CVE-2019-1054

Microsoft Edge 安全功能绕过漏洞

Important

8

Microsoft Exchange Server

ADV190018

Microsoft Exchange Server Defense in Depth Update

Unknown

9

Microsoft Graphics Component

CVE-2019-1009

Windows GDI 信息泄露漏洞

Important

10

Microsoft Graphics Component

CVE-2019-1010

Windows GDI 信息泄露漏洞

Important

11

Microsoft Graphics Component

CVE-2019-1011

Windows GDI 信息泄露漏洞

Important

12

Microsoft Graphics Component

CVE-2019-1012

Windows GDI 信息泄露漏洞

Important

13

Microsoft Graphics Component

CVE-2019-1013

Windows GDI 信息泄露漏洞

Important

14

Microsoft Graphics Component

CVE-2019-1015

Windows GDI 信息泄露漏洞

Important

15

Microsoft Graphics Component

CVE-2019-1016

Windows GDI 信息泄露漏洞

Important

16

Microsoft Graphics Component

CVE-2019-1018

DirectX 特权提升漏洞

Important

17

Microsoft Graphics Component

CVE-2019-1046

Windows GDI 信息泄露漏洞

Important

18

Microsoft Graphics Component

CVE-2019-1047

Windows GDI 信息泄露漏洞

Important

19

Microsoft Graphics Component

CVE-2019-1048

Windows GDI 信息泄露漏洞

Important

20

Microsoft Graphics Component

CVE-2019-1049

Windows GDI 信息泄露漏洞

Important

21

Microsoft Graphics Component

CVE-2019-1050

Windows GDI 信息泄露漏洞

Important

22

Microsoft Graphics Component

CVE-2019-0960

Win32k 特权提升漏洞

Important

23

Microsoft Graphics Component

CVE-2019-0968

Windows GDI 信息泄露漏洞

Important

24

Microsoft Graphics Component

CVE-2019-0977

Windows GDI 信息泄露漏洞

Important

25

Microsoft Graphics Component

CVE-2019-0985

Microsoft Speech API 远程代码执行漏洞

Critical

26

Microsoft JET Database Engine

CVE-2019-0904

Jet Database Engine 远程代码执行漏洞

Important

27

Microsoft JET Database Engine

CVE-2019-0905

Jet Database Engine 远程代码执行漏洞

Important

28

Microsoft JET Database Engine

CVE-2019-0906

Jet Database Engine 远程代码执行漏洞

Important

29

Microsoft JET Database Engine

CVE-2019-0907

Jet Database Engine 远程代码执行漏洞

Important

30

Microsoft JET Database Engine

CVE-2019-0908

Jet Database Engine 远程代码执行漏洞

Important

31

Microsoft JET Database Engine

CVE-2019-0909

Jet Database Engine 远程代码执行漏洞

Important

32

Microsoft JET Database Engine

CVE-2019-0974

Jet Database Engine 远程代码执行漏洞

Important

33

Microsoft Office

CVE-2019-1034

Microsoft Word 远程代码执行漏洞

Important

34

Microsoft Office

CVE-2019-1035

Microsoft Word 远程代码执行漏洞

Important

35

Microsoft Office SharePoint

CVE-2019-1036

Microsoft Office SharePoint XSS Vulnerability

Important

36

Microsoft Office SharePoint

CVE-2019-1031

Microsoft Office SharePoint XSS Vulnerability

Important

37

Microsoft Office SharePoint

CVE-2019-1032

Microsoft Office SharePoint XSS Vulnerability

Important

38

Microsoft Office SharePoint

CVE-2019-1033

Microsoft Office SharePoint XSS Vulnerability

Important

39

Microsoft scripting Engine

CVE-2019-0988

scripting Engine 内存破坏漏洞

Critical

40

Microsoft scripting Engine

CVE-2019-0989

Chakra scripting Engine 内存破坏漏洞

Critical

41

Microsoft scripting Engine

CVE-2019-1055

scripting Engine 内存破坏漏洞

Critical

42

Microsoft scripting Engine

CVE-2019-0920

scripting Engine 内存破坏漏洞

Moderate

43

Microsoft scripting Engine

CVE-2019-0990

scripting Engine 信息泄露漏洞

Critical

44

Microsoft scripting Engine

CVE-2019-0991

Chakra scripting Engine 内存破坏漏洞

Critical

45

Microsoft scripting Engine

CVE-2019-0992

Chakra scripting Engine 内存破坏漏洞

Critical

46

Microsoft scripting Engine

CVE-2019-0993

Chakra scripting Engine 内存破坏漏洞

Critical

47

Microsoft scripting Engine

CVE-2019-1002

Chakra scripting Engine 内存破坏漏洞

Critical

48

Microsoft scripting Engine

CVE-2019-1003

Chakra scripting Engine 内存破坏漏洞

Critical

49

Microsoft scripting Engine

CVE-2019-1023

scripting Engine 信息泄露漏洞

Critical

50

Microsoft scripting Engine

CVE-2019-1024

Chakra scripting Engine 内存破坏漏洞

Critical

51

Microsoft scripting Engine

CVE-2019-1051

Chakra scripting Engine 内存破坏漏洞

Critical

52

Microsoft scripting Engine

CVE-2019-1052

Chakra scripting Engine 内存破坏漏洞

Critical

53

Microsoft scripting Engine

CVE-2019-1080

scripting Engine 内存破坏漏洞

Moderate

54

Microsoft Windows

CVE-2019-0888

ActiveX Data Objects (ADO) 远程代码执行漏洞

Critical

55

Microsoft Windows

CVE-2019-0943

Windows ALPC 特权提升漏洞

Important

56

Microsoft Windows

CVE-2019-0948

Windows Event Viewer 信息泄露漏洞

Moderate

57

Microsoft Windows

CVE-2019-0959

Windows Common Log File System Driver 特权提升漏洞

Important

58

Microsoft Windows

CVE-2019-0984

Windows Common Log File System Driver 特权提升漏洞

Important

59

Microsoft Windows

CVE-2019-0709

Windows Hyper-V 远程代码执行漏洞

Critical

60

Microsoft Windows

CVE-2019-0710

Windows Hyper-V 拒绝服务漏洞

Important

61

Microsoft Windows

CVE-2019-0711

Windows Hyper-V 拒绝服务漏洞

Important

62

Microsoft Windows

CVE-2019-0713

Windows Hyper-V 拒绝服务漏洞

Important

63

Microsoft Windows

CVE-2019-0722

Windows Hyper-V 远程代码执行漏洞

Critical

64

Microsoft Windows

CVE-2019-0983

Windows Storage Service 特权提升漏洞

Important

65

Microsoft Windows

CVE-2019-0998

Windows Storage Service 特权提升漏洞

Important

66

Microsoft Windows

CVE-2019-1025

Windows 拒绝服务漏洞

Important

67

Microsoft Windows

CVE-2019-1043

Comctl32 远程代码执行漏洞

Important

68

Microsoft Windows

CVE-2019-1045

Windows Network File System 特权提升漏洞

Important

69

Microsoft Windows

CVE-2019-1064

Windows 特权提升漏洞

Important

70

Microsoft Windows

CVE-2019-1069

Task Scheduler 特权提升漏洞

Important

71

Servicing Stack Updates

ADV990001

Latest Servicing Stack Updates

Critical

72

Skype for Business and Microsoft Lync

CVE-2019-1029

Skype for Business and Lync Server 拒绝服务漏洞

Important

73

Team Foundation Server

CVE-2019-0996

Azure DevOps Server 欺骗漏洞

Important

74

vbscript

CVE-2019-1005

scripting Engine 内存破坏漏洞

Important

75

Windows Authentication Methods

CVE-2019-1040

Windows NTLM Tampering Vulnerability

Important

76

Windows Hyper-V

CVE-2019-0620

Windows Hyper-V 远程代码执行漏洞

Critical

77

Windows IIS

CVE-2019-0941

Microsoft IIS Server 拒绝服务漏洞

Important

78

Windows Installer

CVE-2019-0973

Windows Installer 特权提升漏洞

Important

79

Windows Kernel

CVE-2019-1014

Win32k 特权提升漏洞

Important

80

Windows Kernel

CVE-2019-1017

Win32k 特权提升漏洞

Important

81

Windows Kernel

CVE-2019-1039

Windows Kernel 信息泄露漏洞

Important

82

Windows Kernel

CVE-2019-1041

Windows Kernel 特权提升漏洞

Important

83

Windows Kernel

CVE-2019-1044

Windows Secure Kernel Mode 安全功能绕过漏洞

Important

84

Windows Kernel

CVE-2019-1065

Windows Kernel 特权提升漏洞

Important

85

Windows Media

CVE-2019-1007

Windows Audio Service 特权提升漏洞

Important

86

Windows Media

CVE-2019-1021

Windows Audio Service 特权提升漏洞

Important

87

Windows Media

CVE-2019-1022

Windows Audio Service 特权提升漏洞

Important

88

Windows Media

CVE-2019-1026

Windows Audio Service 特权提升漏洞

Important

89

Windows Media

CVE-2019-1027

Windows Audio Service 特权提升漏洞

Important

90

Windows Media

CVE-2019-1028

Windows Audio Service 特权提升漏洞

Important

91

Windows NTLM

CVE-2019-1019

Microsoft Windows 安全功能绕过漏洞

Important

92

Windows Shell

CVE-2019-0986

Windows User Profile Service 特权提升漏洞

Important

93

Windows Shell

CVE-2019-1053

Windows Shell 特权提升漏洞

Important

 

【风险评级】

高危

【影响范围】

6月漏洞及补丁涉及组件如下:

  Adobe Flash Player

  Kerberos

  Microsoft Browsers

  Microsoft Devices

  Microsoft Edge

  Microsoft Exchange Server

  Microsoft Graphics Component

  Microsoft JET Database Engine

  Microsoft Office

  Microsoft Office SharePoint

  Microsoft scripting Engine

  Microsoft Windows

  Servicing Stack Updates

  Skype for Business and Microsoft Lync

  Team Foundation Server

  vbscript

  Windows Authentication Methods

  Windows Hyper-V

  Windows IIS

  Windows Installer

  Windows Kernel

  Windows Media

  Windows NTLM

  Windows Shell

【修复建议】

1、建议用户关注并依据业务评估实际漏洞影响,选择更新相关产品补丁,以提高系统安全性;

2、修复方法:打开 Windows Update 更新功能,点击“检查更新”按钮,依据业务需求下载安装相关安全补丁,安装完毕后重启系统,并检查系统运行情况;

3、如仅修复NTLM 协议安全漏洞(CVE-2019-1040),也可单独下载补丁并更新,安装完毕后重启系统,补丁下载地址:https://portal.msrc.microsoft.com/zh-CN/security-guidance/advisory/CVE-2019-1040

【参考链接】

https://support.microsoft.com/en-us/help/20190611/security-update-deployment-information-june-11-2019

特别提醒:修复漏洞前请进行充分测试,并务必做好数据备份和快照,防止出现意外。

 

Call us

400-151-8800

Email us

cloud@pingan.com

Online customer service

Instant reply

Technical Support

cloud products