• 發布單位:TWCERT/CC
• 更新日期:2024-05-23
• 點閱次數:1008

• 內容說明：

研究人員發現Microsoft Windows MSHTML平台存在安全功能繞過(Security Feature Bypass)漏洞(CVE-2024-30040)，遠端攻擊者可藉由誘騙使用者下載與開啟惡意檔案，繞過Microsoft 365與Office之物件連結與嵌入(OLE)防護機制，進而利用此漏洞達到遠端執行任意程式碼。該漏洞已遭駭客利用，請儘速確認並進行修補。

• 影響平台：

Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 11 version 21H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server 2022, 23H2 Edition (Server Core installation)

• 處置建議：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040