安全公告編號:CNTA-2021-0026
2021年9月8日，國家信息安全漏洞共享平臺（CNVD）收錄了Microsoft MSHTML遠程代碼執行漏洞（CNVD-2021-69088，對應CVE-2021-40444）。攻擊者利用該漏洞⛩，可在未授權的情況下遠程執行代碼。目前🪃🫙，漏洞利用細節已在小範圍公開👨🏻🦽➡️，微軟公司暫未發布補丁修復該漏洞✭。CNVD建議受影響用戶按照臨時防範措施緩解漏洞攻擊威脅🍫。
一、漏洞情況分析
MSHTML（又稱Trident）是微軟Windows操作系統Internet Explorer（IE）瀏覽器的排版組件。軟件開發人員使用該組件🚣🏼，可以在應用中快速實現網頁瀏覽功能。MSHTML除應用於IE瀏覽器、IE內核瀏覽器外，還在Office的Word🏬、Excel和PowerPoint文檔中用來呈現Web托管內容。
9月7日，微軟公司發布了針對Microsoft MSHTML遠程代碼執行漏洞的緊急安全公告🧝🏻♀️。攻擊者利用該漏洞，通過精心構造包含可被加載的惡意 ActiveX控件的Microsoft Office文件🧑🏽🚀，並誘導受害者打開文檔，從而觸發此漏洞🧏🏼♀️。未經身份驗證的攻擊者利用該漏洞🤜🏼🥚，可獲得受害者的當前用戶權限👨🏻🦽，以該用戶權限執行任意代碼🧸。
CNVD對該漏洞的綜合評級為“高危”。
二🟥🔸、漏洞影響範圍
漏洞影響的產品版本包括：
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
三、漏洞處置建議
目前，微軟公司暫未發布補丁程序修復該漏洞🧑🏿⚕️。CNVD建議受影響用戶謹慎訪問來源不明的Office文件或網頁鏈接，具備一定專業知識的用戶可通過更改註冊表配置禁用ActiveX控件（建議操作前先做備份），並及時關註廠商的更新公告🧕🏽。
附🧑🧒🧒：參考鏈接🧜🏼♂️：
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
https://www.bleepingcomputer.com/news/security/microsoft-shares-temp-fix-for-ongoing-office-365-zero-day-attacks/
感謝CNVD技術組支撐單位——奇安信科技集團股份有限公司、北京天融信網絡安全技術有限公司為本報告提供的技術支持。
