- CNNVD编号:未知
- 危害等级: 高危
- CVE编号:CVE-2021-34527
- 漏洞类型: 未知
- 威胁类型:未知
- 厂 商:未知
- 漏洞来源:金山毒霸
- 发布时间:2021-07-05
- 更新时间:2021-07-05
漏洞简介
2021年7月1日,微软发布了Windows Print Spooler远程代码执行漏洞(CVE-2021-34527)。日前,该漏洞的exp已在网络上公开。微软官方暂无相关补丁。该exp可以绕过微软6月针对CVE-2021-1675的补丁。建议相关用户尽早做好缓解措施,暂时关闭相关的Print Spooler服务。
Windows Print Spooler是Windows的打印机后台处理程序,广泛的应用于各种内网中,攻击者可以利用该0day漏洞使用一个低权限用户(包括匿名共享guest账户),对本地网络中的电脑发起攻击,控制存在漏洞的电脑。尤其在企业内部,在域环境中,普通域用户,可以通过该服务,攻击域控服务器,从而控制整个网络。
此次泄漏的exp利用难度低,同时该漏洞广泛存在于各个Windows版本中。且成功利用该漏洞的攻击者可以完整的控制域环境,攻击可能造成的后果严重,所以该漏洞的利用价值极高。
毒霸安全专家建议相关用户尽快升级系统以修复该漏洞,避免受到黑客攻击。
漏洞公示
参考网站
受影响实体
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2012 R2
- Windows Server 2012 (Server Core installation)
- Windows Server 2012
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Coreinstallation)
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 for x64-based Systems Service Pack 2 (Server Coreinstallation)
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Coreinstallation)
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows RT 8.1
- Windows 8.1 for x64-based systems
- Windows 8.1 for 32-bit systems
- Windows 7 for x64-based Systems Service Pack 1
- Windows 7 for 32-bit Systems Service Pack 1
- Windows Server 2016 (Server Coreinstallation)
- Windows Server 2016
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows Server, version 20H2 (Server Core Installation)
- Windows 10 Version 20H2 for ARM64-based Systems
- Windows 10 Version 20H2 for 32-bit Systems
- Windows 10 Version 20H2 for x64-based Systems
- Windows Server, version 2004 (Server Core installation)
- Windows 10 Version 2004 for x64-based Systems
- Windows 10 Version 2004 for ARM64-based Systems
- Windows 10 Version 2004 for 32-bit Systems
- Windows 10 Version 21H1 for 32-bit Systems
- Windows 10 Version 21H1 for ARM64-based Systems
- Windows 10 Version 21H1 for x64-based Systems
- Windows Server, version 1909 (Server Core installation)
- Windows 10 Version 1909 for ARM64-based Systems
- Windows 10 Version 1909 for x64-based Systems
- Windows 10 Version 1909 for 32-bit Systems
- Windows Server 2019 (Server Coreinstallation)
- Windows Server 2019
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
补丁
目前正式补丁尚未发布,相关用户可以通过禁用Print Spooler服务来缓解漏洞风险。
临时解决方案:
运行service.msc,在服务列表中找到PrintSpooler服务。
右键打开服务属性,将服务类型修改为“禁用”,并停止该服务。
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527