漏洞描述

Windows秘钥交换服务远程代码执行漏洞(CVE-2022-34721)情报，相关服务代码未能正确校验接收到的数据，使得攻击者能够在未认证的情况下，构造一个畸形的数据包发往服务端，对目标主机进行DDoS攻击甚至获取主机权限。Windows秘钥交换服务用于IPSec协议中的身份校验和秘钥交换，在VPN中使用较为广泛。
 

受影响版本

Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
 

漏洞复现

https://github.com/78ResearchLab/PoC/tree/main/CVE-2022-34721

解决方案

正式防护方案

微软官方已发布相关补丁：
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34721
 

缓解措施

缓解是指以默认状态存在的设置、通用配置或一般最佳实践，可以降低利用漏洞的严重性。以下缓解因素可能对您的情况有所帮助：
只有运行 IKE 和 AuthIP IPsec 密钥模块的系统才容易受到这种攻击。
您可以运行以下任一命令来检查该服务的运行状态：
PS： C:> Get-Service Ikeext
或者
命令：C:> sc query ikeext
这种缓解可能会对您的 IPSec 功能产生负面影响。Microsoft 强烈建议使用 2022 年 9 月的安全更新来更新您的系统。
 

感谢您的来访，获取更多精彩文章请收藏本站。