微軟12月Patch Tuesday修補逾30個安全漏洞
· 2023-12-14
一個源自於AMD晶片、已被公開的零時差漏洞CVE-2023-20588，需要更新軟體平臺才能緩解，促使微軟在12月Patch Tuesday更新了Windows
此次有兩個重大漏洞與網路連線分享（Internet Connection Sharing，ICS）有關，分別是CVE-2023-35641與CVE-2023-35630，這是Windows的內建服務，允許一臺連網電腦與其它電腦分享網路連線。這兩個漏洞都僅能攻擊與駭客處於同一網路交換器或虛擬網路的系統，駭客可藉由傳送惡意DHCP訊息至執行ICS服務的伺服器，或是變更某個輸入訊息的長度欄位選項，來觸發相關漏洞，成功的攻擊將允許駭客自遠端執行程式。
不過，ICS服務的預設值是關閉的，且不常被使用。
另一個同樣允許遠端程式攻擊的重大漏洞為CVE-2023-35628，它牽涉到Microsoft Edge的IE模式所使用的Windows MSHTML Platform，駭客可透過電子郵件傳送一個惡意連結，當受害者點選該連結之後，即可允許駭客執行任意程式。
本月微軟修補的最嚴重漏洞為CVE-2023-36019，其CVSS風險評分高達9.6，該漏洞與Microsoft Power Platform Connector有關，屬於欺騙漏洞，允許駭客將惡意的連結、應用程式或檔案偽裝成合法的以吸引受害者，最終也可導致遠端程式攻擊。
此外，CVE-2023-36019漏洞其實位在網頁伺服器上，但惡意腳本程式則是在使用者的瀏覽器上執行。
Popular articles
British gambling levy rates confirmed for each vertical
Regulation
GAT Expo CDMX 2026 Kicks Off Today in Mexico with a Sold-Out Opening Reception at Big Bola Casino Santa Fe
Marketing
Vietnam’s Controlled Gaming Shift Gains Ground, But Domestic Demand Still Lags
Southeast Asia
That’s a Wrap: AffPapa Conference Madrid 2026 Highlights
Online Game
Manila delivers: Highlights from SiGMA Asia 2026
Southeast Asia
JILI Partners with Cricket Legend AB de Villiers (ABD) to Launch Exclusive Branded Game Series 100% 11
Sports Game
1spin4win releases unique slot Don Catleone Hold and Win featuring gangster cats
Online Game
Super PAC Raises $48 Million: Sports Betting Forces Ramp Up Political Push
Regulation
Zenith partners with HUIDU for 2026 World Cup Carnival Official Tour
Online Game
New Jersey July Gambling Revenue Hits $606M, Sweeps Casinos Banned
Regulation
What’s on the SBC Summit Conference Agenda in 2026?
Marketing
1spin4win grows its Latin American presence by partnering with Fortuna Juegos
Online Game
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
Full House at GAT Expo Cartagena 2026 Academic Agenda
Online Game
PropellerAds Positions Itself as a Go-To Traffic Source for iGaming Advertisers Ahead of a High-Demand Season
Marketing
