微软发布9月份安全补丁，修复61个安全漏洞
微软在昨日例行更新中发布了9月份的安全补丁，修复了61个安全漏洞。其中有17个漏洞被标记为关键漏洞，43个为重要漏洞，1个为中等严重漏洞。此次更新兑现了上次官方的承诺，修复了近日某安全研究员在推特上公布的计划任务0day漏洞（此漏洞之前已经有第三方安全补丁进行修复）。
此次漏洞与以往相同，涉及到微软主流产品，包括Edge，Windows，IE，Office，.NET Framework等。
四个漏洞此前已经公开，存在被利用可能性
CVE-2018-8475 Windows远程代码执行漏洞
此漏洞影响当前所有的Windows版本（包括Win10），并且利用方式非常简单，攻击者只需要诱导用户查看一张攻击者特制的图像文件即可实施攻击。
鉴于其利用方式，未来可能会有非常多的钓鱼攻击会利用此漏洞。
CVE-2018-8440 Windows ALPC提权漏洞
此漏洞为近日某安全研究员在推特上公布的漏洞，该漏洞可让攻击者实现提权，此前PoC已经发布在Github上，并且短时间内第三方安全补丁和解决方案也及时公布。此次官方正式修复了该漏洞。
CVE-2018-8457 Scripting Engine内存破坏漏洞
该漏洞影响IE 10与11，同时还影响Edge，可让攻击者实现以当前登录用户的权限实施远程代码执行。
CVE-2018-8409 System.IO.Pipelines 拒绝服务漏洞
此漏洞为ASP.NET中的漏洞，当System.IO.Pipelines处理请求发生错误时会导致拒绝服务，攻击者可在未授权状态下远程触发此漏洞。
其他需要解决的漏洞
Talos和ZDI总结了当前需要立即更新解决的危险漏洞，除上述漏洞外还有以下这些：
CVE-2018-0965/8439
此漏洞因处理用户输入时未进行有效验证，可让攻击者在虚拟机中通过Hyper-V底层执行命令，虽然官方定义为远程代码执行，但实际上攻击者需要在Guest虚拟机中执行命令。
CVE-2018-8449
此漏洞可让攻击者绕过Device Guard的安全签名机制从而执行恶意软件。
CVE-2018-8367
此漏洞为Chakra脚本引擎中的远程代码执行漏洞，处理Edge内存对象出现错误时可让攻击者以当前用户权限远程执行代码。
CVE-2018-8420
此漏洞为MSXML的远程代码执行漏洞，攻击者诱导用户访问恶意网站后可实现远程代码执行。
CVE-2018-8461/8447
此漏洞为IE中的远程代码执行漏洞，与上一个漏洞相同可让攻击者诱导用户访问恶意网站后以当前登录用户权限实现远程代码执行。
CVE-2018-8332
此漏洞为字体库的远程代码执行漏洞，攻击者可通过诱导用户访问恶意网站、恶意文档等方式实现远程代码执行。
CVE-2018-8391
此漏洞为Chakra脚本引擎的远程代码执行漏洞，只有当用户以管理员身份登录时，攻击者才可利用此漏洞。
CVE-2018-8456/8459
此漏洞为Chakra脚本引擎的远程代码执行漏洞，当其处理内存对象发生错误时，攻击者可以当前登录用户权限实现远程代码执行。
CVE-2018-8464
此漏洞为Edge中的远程代码执行漏洞，存在于内置的PDF阅读器中。攻击者可诱导用户访问恶意PDF实现远程代码执行。
漏洞详情列表
CVE Title Severity Public Exploited XI – Latest XI – Older Type CVE-2018-8440 Windows ALPC Elevation of Privilege Vulnerability Important Yes Yes 1 1 EoP CVE-2018-8475 Windows Remote Code Execution Vulnerability Critical Yes No 1 1 RCE CVE-2018-8457 Scripting Engine Memory Corruption Vulnerability Critical Yes No 1 N/A RCE CVE-2018-8409 ASP.NET Core Denial of Service Important Yes No 2 2 DoS CVE-2018-0965 Windows Hyper-V Remote Code Execution Vulnerability Critical No No N/A 2 RCE CVE-2018-8367 Chakra Scripting Engine Memory Corruption Vulnerability Critical No No 1 N/A RCE CVE-2018-8420 MS XML Remote Code Execution Vulnerability Critical No No 1 1 RCE CVE-2018-8461 Internet Explorer Memory Corruption Vulnerability Critical No No 1 1 RCE CVE-2018-8332 Win32k Graphics Remote Code Execution Vulnerability Critical No No 2 2 RCE CVE-2018-8391 Scripting Engine Memory Corruption Vulnerability Critical No No 1 N/A RCE CVE-2018-8421 .NET Framework Remote Code Execution Vulnerability Critical No No 2 2 RCE CVE-2018-8439 Windows Hyper-V Remote Code Execution Vulnerability Critical No No 2 2 RCE CVE-2018-8447 Internet Explorer Memory Corruption Vulnerability Critical No No 1 1 RCE CVE-2018-8456 Scripting Engine Memory Corruption Vulnerability Critical No No 1 N/A RCE CVE-2018-8459 Scripting Engine Memory Corruption Vulnerability Critical No No 1 N/A RCE CVE-2018-8464 Microsoft Edge PDF Remote Code Execution Vulnerability Critical No No 1 N/A RCE CVE-2018-8465 Chakra Scripting Engine Memory Corruption Vulnerability Critical No No 1 N/A RCE CVE-2018-8466 Chakra Scripting Engine Memory Corruption Vulnerability Critical No No 1 N/A RCE CVE-2018-8467 Chakra Scripting Engine Memory Corruption Vulnerability Critical No No 1 N/A RCE CVE-2018-8479 Azure IoT SDK Spoofing Vulnerability Important No No N/A N/A Spoof CVE-2018-8269 Odata Denial of Service Vulnerability Important No No 2 2 DoS CVE-2018-8335 Windows SMB Denial of Service Vulnerability Important No No 2 2 DoS CVE-2018-8436 Windows Hyper-V Denial of Service Vulnerability Important No No 2 2 DoS CVE-2018-8437 Windows Hyper-V Denial of Service Vulnerability Important No No 2 2 DoS CVE-2018-8438 Windows Denial of Service Vulnerability Important No No 2 2 DoS CVE-2018-8410 Windows Registry Elevation of Privilege Vulnerability Important No No 1 1 EoP CVE-2018-8462 DirectX Graphics Kernel Elevation of Privilege Vulnerability Important No No 1 1 EoP CVE-2018-8428 Microsoft SharePoint Elevation of Privilege Vulnerability Important No No 2 2 EoP CVE-2018-8431 Microsoft SharePoint Elevation of Privilege Vulnerability Important No No 2 2 EoP CVE-2018-8441 Windows Subsystem for Linux Elevation of Privilege Vulnerability Important No No 2 2 EoP CVE-2018-8455 Windows Kernel Elevation of Privilege Vulnerability Important No No 2 2 EoP CVE-2018-8463 Microsoft Edge Elevation of Privilege Vulnerability Important No No 1 N/A EoP CVE-2018-8468 Windows Elevation of Privilege Vulnerability Important No No 1 N/A EoP CVE-2018-8469 Microsoft Edge Elevation of Privilege Vulnerability Important No No 1 N/A EoP CVE-2018-8271 Windows Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8315 Microsoft Scripting Engine Information Disclosure Vulnerability Important No No 2 N/A Info CVE-2018-8336 Windows Kernel Information Disclosure Vulnerability Important No No N/A 2 Info CVE-2018-8419 Windows Kernel Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8424 Windows GDI Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8433 Microsoft Graphics Component Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8429 Microsoft Excel Information Disclosure Vulnerability Important No No 2 N/A Info CVE-2018-8434 Windows Hyper-V Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8442 Windows Kernel Information Disclosure Vulnerability Important No No 1 1 Info CVE-2018-8443 Windows Kernel Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8444 Windows SMB Information Disclosure Vulnerability Important No No N/A 2 Info CVE-2018-8445 Windows Kernel Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8446 Windows Kernel Information Disclosure Vulnerability Important No No 2 2 Info CVE-2018-8452 Scripting Engine Information Disclosure Vulnerability Important No No 1 N/A Info CVE-2018-8354 Scripting Engine Memory Corruption Vulnerability Important No No 1 N/A RCE CVE-2018-8366 Microsoft Edge Information Disclosure Vulnerability Important No No 1 N/A RCE CVE-2018-8392 Microsoft JET Database Engine Remote Code Execution Vulnerability Important No No 2 2 RCE CVE-2018-8393 Microsoft JET Database Engine Remote Code Execution Vulnerability Important No No 2 2 RCE CVE-2018-8430 Word PDF Remote Code Execution Vulnerability Important No No 1 1 RCE CVE-2018-8331 Microsoft Excel Remote Code Execution Vulnerability Important No No 1 N/A RCE CVE-2018-8337 Windows Subsystem for Linux Security Feature Bypass Vulnerability Important No No 2 2 SFB CVE-2018-8435 Windows Hyper-V Security Feature Bypass Vulnerability Important No No 2 2 SFB CVE-2018-8449 Device Guard Security Feature Bypass Vulnerability Important No No 1 1 SFB CVE-2018-8470 Internet Explorer Security Feature Bypass Vulnerability Important No No 1 1 SFB CVE-2018-8425 Microsoft Edge Spoofing Vulnerability Important No No 1 N/A Spoof CVE-2018-8426 Microsoft Office SharePoint XSS Vulnerability Important No No 2 2 XSS CVE-2018-8474 Lync for Mac 2011 Security Feature Bypass Vulnerability Moderate No No N/A 2 SFB
参考链接
https://blog.talosintelligence.com/2018/09/ms-tuesday.html
https://www.zerodayinitiative.com/blog/2018/9/11/the-september-2018-security-update-review
https://thehackernews.com/2018/09/microsoft-software-updates.html
https://www.symantec.com/blogs/threat-intelligence/microsoft-patch-tuesday-september-2018
文章原文链接:https://www.anquanke.com/post/id/159537
