Office尚無更新版的漏洞可能導致敏感資料外洩,多個版本受影響
行銷管道 · 2024-08-12

微軟於8月8日公布一項影響Office的安全漏洞CVE-2024-38200,可造成敏感資訊洩露給未經授權的攻擊者,同時說明有效版本的Office、M365用戶已獲得防護,但仍需安裝預定在臺灣時間8月14日釋出的安全更新

微軟說明本漏洞的攻擊手法。在Web攻擊情境中,攻擊者中可能設立惡意網頁或濫用被駭網站代管惡意檔案,以便濫用該漏洞。攻擊者必須利用社交工程,像是郵件或即時通訊等手法誘使用戶點擊連結,並說服他們開啟惡意檔案。

微軟並未描述Office何以出現漏洞,也未說明可能洩露的敏感資訊為何。但根據微軟提供的暫時性防禦方法,顯示可能曝光的是NTLM雜湊。該防禦方法說,配置「網路安全:限制NTLM:NTLM流量外流至遠端伺服器」政策,可設定防堵或稽核所有試圖從Windows Server 2008、Server 2008 R2等以上版本,經過NTLM驗證連向遠端Windows伺服器的行為。

目前這漏洞是還沒有修補程式的,微軟預定在8月13日的安全更新(臺灣時間8月14日)修補本漏洞。但微軟說明,微軟在7月30日的Feature Flighting,已經包含了一個可提供防護的另一修補程式。Feature Flighting是以Feature Flags方式,在微軟控制下逐步部署軟體功能給用戶端的更新方法,涵括Office或Windows功能或安全更新。微軟說,所有有效版本的Office、Microsoft 365用戶都已獲得防護了,只是用戶到時還是必須升級到8/13/2024更新版以獲得最終版修補。

在更新軟體到來之前,其他防護方法包括將用戶加入到「防護用戶的安全群組」,防止使用NTLM作為驗證機制。其次設定防火牆或VPN,封鎖TCP 445/SMB傳輸埠的向外流量,以防NTML驗證資訊送到外部檔案共享伺服器。

Popular articles
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
GAT CDMX 2025 Institutional Academy: Leaders and Experts Analyze the Present and Future of the Gaming Industry in Mexico and Lat
Sports Game
Vietnam’s Controlled Gaming Shift Gains Ground, But Domestic Demand Still Lags
Southeast Asia
UK MPs reopen 2025 gambling inquiry as reform stalls
Regulation
HUIDU Invites You to Booth T70 at iGB L!VE 2026 — Let’s Ignite London This July!
HUIDU Focus
B2B Tech Infrastructure Gains Momentum in Philippine Gaming Sector
Southeast Asia
New Jersey July Gambling Revenue Hits $606M, Sweeps Casinos Banned
Regulation
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
1spin4win releases unique slot Don Catleone Hold and Win featuring gangster cats
Online Game
Across 6 Cities: HUIDU Invites You to 8 World Cup Parties Redefining High-Value Social Networking
HUIDU Focus
Are you ready to maximize your earnings? Try ProPush.me Constructor!
Marketing
Brazil Proposes Raising Gambling Tax Rate to 24%, With Revenue Allocated to Social Security and Healthcare
Regulation
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
1spin4win grows its Latin American presence by partnering with Fortuna Juegos
Online Game
Full House at GAT Expo Cartagena 2026 Academic Agenda
Online Game
Home
Game
Cooperation
Find
My