windows2008r2补丁_安全预警 ——【附补丁下载链接】关于Microsoft Windows远程桌面服务远程代码执行漏洞（CVE20190708）...

1   漏洞描述

5月14日，微软发布的5月份月度更新中修复了一个Microsoft Windows 远程桌面服务远程代码执行漏洞(CVE-2019-0708)。攻击者利用该漏洞，可在未授权的情况下远程执行代码。该漏洞危害程度为高危(High)。目前，厂商针对该漏洞已发布安全补丁。

2   影响范围

受影响版本：

Windows7 for 32-bit Systems Service Pack 1

Windows7 for x64-based Systems Service Pack 1

WindowsServer 2008 for 32-bit Systems Service Pack 2

WindowsServer 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

WindowsServer 2008 for Itanium-Based Systems Service Pack 2

WindowsServer 2008 for x64-based Systems Service Pack 2

WindowsServer 2008 for x64-based Systems Service Pack 2 (Server Core installation)

WindowsServer 2008 R2 for Itanium-Based Systems Service Pack 1

WindowsServer 2008 R2 for x64-based Systems Service Pack 1

WindowsServer 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

WindowsXP SP3 x86

WindowsXP Professional x64 Edition SP2

WindowsXP Embedded SP3 x86

WindowsServer 2003 SP2 x86

WindowsServer 2003 x64 Edition SP2

注意：Windows8和Windows 10及之后版本的用户不受此漏洞影响

3   漏洞原理

MicrosoftWindows是美国微软公司发布的视窗操作系统。远程桌面连接是微软从Windows 2000 Server开始提供的组件。

未经身份验证的攻击者利用该漏洞，向目标Windows主机发送恶意构造请求，可以在目标系统上执行任意代码；该漏洞影响了某些旧版本的Windows系统，此漏洞是预身份验证且无需用户交互，意味该漏洞可以通过网络蠕虫的方式被利用。利用此漏洞的任何恶意软件都可能从被感染的计算机传播到其他易受攻击的计算机，其方式与2017年WannaCry恶意软件的传播方式类似。

      4  修复建议

1)目前，官方已发布安全补丁，建议用户前往微软官方下载对应的安全补丁：     

• Windows7, Windows 2008 R2, and Windows 2008：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

• Windows2003 and Windows XP：

https://support.microsoft.com/zh-cn/help/4500705/customer-guidance-for-cve-2019-0708

  对应补丁的下载地址：

系统版本	下载链接
Windows 7 x86	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x86_6f1319c32d5bc4caf2058ae8ff40789ab10bf41b.msu
Windows 7 x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x64_3704acfff45ddf163d8049683d5a3b75e49b58cb.msu
Windows Embedded Standard 7 for x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x64_3704acfff45ddf163d8049683d5a3b75e49b58cb.msu
Windows Embedded Standard 7 for x86	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x86_6f1319c32d5bc4caf2058ae8ff40789ab10bf41b.msu
Windows Server 2008 x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.0-kb4499149-x64_9236b098f7cea864f7638e7d4b77aa8f81f70fd6.msu
Windows Server 2008 Itanium	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.0-kb4499180-ia64_805e448d48ab8b1401377ab9845f39e1cae836d4.msu
Windows Server 2008 x86	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.0-kb4499149-x86_832cf179b302b861c83f2a92acc5e2a152405377.msu
Windows Server 2008 R2 Itanium	http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-ia64_fabc8e54caa0d31a5abe8a0b347ab4a77aa98c36.msu
Windows Server 2008 R2 x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x64_3704acfff45ddf163d8049683d5a3b75e49b58cb.msu
Windows Server 2003 x86	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsserver2003-kb4500331-x86-custom-chs_4892823f525d9d532ed3ae36fc440338d2b46a72.exe
Windows Server 2003 x64	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsserver2003-kb4500331-x64-custom-chs_f2f949a9a764ff93ea13095a0aca1fc507320d3c.exe
Windows XP SP3	http://download.windowsupdate.com/c/csa/csa/secu/2019/04/windowsxp-kb4500331-x86-custom-chs_718543e86e06b08b568826ac13c05f967392238c.exe
Windows XP SP2 for x64	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsserver2003-kb4500331-x64-custom-enu_e2fd240c402134839cfa22227b11a5ec80ddafcf.exe
Windows XP SP3 for XPe	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsxp-kb4500331-x86-embedded-custom-chs_96da48aaa9d9bcfe6cd820f239db2fe96500bfae.exe
WES09 and POSReady 2009	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/04/windowsxp-kb4500331-x86-embedded-chs_e3fceca22313ca5cdda811f49a606a6632b51c1c.exe

2)临时措施：

• 禁用远程桌面服务。

• 通过主机防火墙对远程桌面服务端口进行阻断(默认为TCP 3389)

• 开启网络身份验证(NLA)：因为NLA要求的身份验证在漏洞触发点之前，所以受影响的系统可以利用NLA防御此漏洞的“蠕虫”恶意软件或高级恶意软件威胁。但是，如果攻击者具有可用于成功进行身份验证的有效凭据，则受影响的系统仍然容易受到远程执行代码执行(RCE)的攻击。