Windows作業系統處理網路封包不當造成3個TCP/IP實作漏洞 CVE-2021-24074、CVE-2021-24094、CVE-2021-24086

 [重大安全性更新通報]

微軟Windows作業系統中的TCP/IP存在安全性漏洞，可讓攻擊者利用漏洞遠端執行任意程式碼(RCE)或阻斷服務(DoS)攻擊。微軟已釋出修補套件，請儘速進行修補。

微軟Windows作業系統存在3個TCP/IP實作漏洞(處理網路封包不當造成) (CVE-2021-24074、CVE-2021-24094、CVE-2021-24086)，其IPv4 Source routing功能存在漏洞，或額外設置IPv6 IP時，則可讓攻擊者利用漏洞遠端執行任意程式碼(RCE)或阻斷服務(DoS)攻擊。微軟已釋出修補套件，相關Patch已部署至WU主機，請儘速進行修補。

詳細官方更新說明請參考微軟官網

一、   CVE-2021-24074、CVE-2021-24094、CVE-2021-24086影響範圍：

CVE CVSS分數 受漏洞影響功能 影響

CVE-2021-24074 9.8 IPv4 Source routing RCE (遠端程式碼執行)

CVE-2021-24094 9.8 IPv6 RCE (遠端程式碼執行)

CVE-2021-24086 7.5 IPv6 DOS (阻斷服務)

二、   修補方式：

微軟受影響產品 修補套件

(Monthly Rollup和Security Only擇一修補即可)

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64-based Systems

Windows 10 Version 2004 for ARM64-based Systems

Windows 10 Version 2004 for 32-bit Systems Security Update:KB4601319

Windows Server, version 1909 (Server Core installation)

Windows 10 Version 1909 for ARM64-based Systems

Windows 10 Version 1909 for x64-based Systems

Windows 10 Version 1909 for 32-bit Systems Monthly Rollup:KB4601380

Security Update: KB4601315

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems Monthly Rollup: KB4601384

Security Only: KB4601349

Windows Server 2012 (Server Core installation)

Windows Server 2012 Monthly Rollup: KB4601348

Security Only: KB4601357

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows 7 for 32-bit Systems Service Pack 1 Monthly Rollup: KB4601347

Security Only: KB4601363

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2 Monthly Rollup: KB4601360

Security Only: KB4601366

Windows RT 8.1 KB4601384

Windows Server 2016  (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems Security Update: KB4601318

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems Security Update:KB4601331

Windows Server 2019  (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems Security Update: KB4601345

Windows 10 Version 1803 for ARM64-based Systems

Windows 10 Version 1803 for x64-based Systems

Windows 10 Version 1803 for 32-bit Systems Security Update: KB4601354

詳細官方更新說明請參考微軟官網，連結如下: 

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24074

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24094

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24086

※ 設備更新前，敬請進行完整評估與測試

※ 請勿使用外部網站進行弱點測試

https://msrc-blog.microsoft.com/2021/02/09/multiple-security-updates-affecting-tcp-ip/