一. 漏洞公告
微软官方发布了1月安全更新公告，包含了微软家族多个软件的安全更新补丁，包括：Microsoft Windows、Edge（基于 Chromium）、Hyper-V、Office、DirectX、Defender等126个CVE安全漏洞。其中包含9个严重和多个高危漏洞。请相关用户及时更新对应补丁修复漏洞。相关链接参考：
https://msrc.microsoft.com/update-guide/releaseNote/2022-Jan
根据公告，此次更新中修复的HTTP 协议栈远程代码执行漏洞（CVE-2022-21907）、Microsoft Office 远程代码执行漏洞（CVE-2022-21840）、Active Directory 域服务特权提升漏洞（CVE-2022-21857）、Win32k 特权提升漏洞（CVE-2022-21882、CVE-2022-21887）等风险较大，建议尽快安装安全更新补丁或采取临时缓解措施加固系统。相关链接参考：
https://msrc.microsoft.com/update-guide/vulnerability/
二. 影响范围
HTTP协议栈远程代码执行漏洞（CVE-2022-21907）：
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)
Microsoft Office 远程代码执行漏洞（CVE-2022-21840）：
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Excel 2013 RT Service Pack 1
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Microsoft Office 2019 for Mac
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft Office LTSC for Mac 2021
Microsoft Office Online Server
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Server 2019
Microsoft SharePoint Server Subscription Edition
SharePoint Server Subscription Edition Language Pack
Active Directory 域服务特权提升漏洞（CVE-2022-21857）：
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)
Win32k 特权提升漏洞（CVE-2022-21882）：
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)
Win32k 特权提升漏洞（CVE-2022-21887）：
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
1月安全公告列表，包含的其他漏洞快速阅读指引：
https://msrc.microsoft.com/update-guide/releaseNote/2022-Jan
三、漏洞描述
HTTP协议栈远程代码执行漏洞（CVE-2022-21907）：
该漏洞允许未经身份验证的攻击者利用HTTP协议栈 (http.sys) 将特制数据包发送到目标服务器来处理数据包触发漏洞，成功利用该漏洞可实现蠕虫攻击，危害极大。在 Windows Server 2019 中，包含该漏洞的功能默认不活动，当用户配置以下注册表项时可能导致易受攻击：
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\ "EnableTrailerSupport"=dword:00000001
Microsoft Office 远程代码执行漏洞（CVE-2022-21840）：
攻击者可以通过向用户发送特制文件并诱使用户打开文件来利用该漏洞，成功利用该漏洞可导致目标主机被黑客控制。
Active Directory 域服务特权提升漏洞（CVE-2022-21857）：
攻击者可利用该漏洞在特定条件下跨信任边界实现权限提升。
Win32k 特权提升漏洞（CVE-2022-21882、CVE-2022-21887）：
经过身份验证的本地攻击者可以通过 Win32k.sys 驱动程序中的漏洞获得提升的本地系统或管理员权限。
四、缓解措施
高危：目前漏洞细节虽未公开，但是恶意攻击者可以通过补丁对比方式分析出漏洞触发点，并进一步开发漏洞利用代码，Microsoft已发布相关安全更新，鉴于漏洞的严重性，建议受影响的用户尽快修复。
（一）Windows 更新：
自动更新：
Microsoft Update默认启用，当系统检测到可用更新时，将会自动下载更新并在下一次启动时安装。
手动更新：
1、点击“开始菜单”或按Windows快捷键，点击进入“设置”2、选择“更新和安全”，进入“Windows更新”（Windows 8、Windows 8.1、Windows Server 2012以及Windows Server 2012 R2可通过控制面板进入“Windows更新”，具体步骤为“控制面板”->“系统和安全”->“Windows更新”）
3、选择“检查更新”，等待系统将自动检查并下载可用更新。
4、重启计算机，安装更新系统重新启动后，可通过进入“Windows更新”->“查看更新历史记录”查看是否成功安装了更新。
（二）目前微软针对支持的产品已发布升级补丁修复了上述漏洞，请用户参考官方通告及时下载更新补丁。
补丁获取：https://msrc.microsoft.com/update-guide/vulnerability
来源：微软官网
/
网络安全