漏洞风险提示（20250115)
免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表安天实验室观点，因此第三方对以下内 容进行分享、传播等行为，以及所带来的一切后果与译者和安天实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与安天实验室一律不予承担。1 Microsoft Windows Brokering File System权限提升漏洞（CVE-2025-21315）
一、漏洞描述：
Microsoft Windows Brokering File System是微软公司的windows代理文件系统。Microsoft Windows Brokering File System存在权限提升漏洞，攻击者可利用该漏洞提升权限。
二、风险等级：
高
三、影响范围：
Microsoft Windows Server 2025 (Server Core installation)
Microsoft Windows Server 2025
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
Microsoft Windows 11 24H2 for x64-based Systems
Microsoft Windows 11 24H2 for ARM64-based Systems
四、修复建议：
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21315
2 Microsoft Windows Remote Desktop Services远程代码执行漏洞（CVE-2025-21309）
一、漏洞描述：
Microsoft Windows Remote Desktop Services是远程桌面服务(RDS)，可以生成虚拟化解决方案来满足每个最终客户的需求。Microsoft Windows Remote Desktop Services存在远程代码执行漏洞，攻击者可利用该漏洞在目标主机上执行代码。
二、风险等级：
高
三、影响范围：
Microsoft Windows Server 2025 (Server Core installation)
Microsoft Windows Server 2025
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
Microsoft Windows Server 2022 (Server Core installation)
Microsoft Windows Server 2022
Microsoft Windows Server 2019 (Server Core installation)
Microsoft Windows Server 2019
Microsoft Windows Server 2016 (Server Core installation)
Microsoft Windows Server 2016
Microsoft Windows Server 2012 R2 (Server Core installation)
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2012 (Server Core installation)
Microsoft Windows Server 2012
四、修复建议：
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21309
3 Microsoft Windows Kerberos安全功能绕过漏洞（CVE-2025-21299）
一、漏洞描述：
Microsoft Windows Kerberos是一种身份验证协议，用于验证用户或主机的标识。Microsoft Windows Kerberos存在安全功能绕过漏洞，攻击者可利用该漏洞执行某些非法操作。
二、风险等级：
高
三、影响范围：
Microsoft Windows Server 2025 (Server Core installation)
Microsoft Windows Server 2025
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
Microsoft Windows Server 2022 (Server Core installation)
Microsoft Windows Server 2022
Microsoft Windows Server 2019 (Server Core installation)
Microsoft Windows Server 2019
Microsoft Windows Server 2016 (Server Core installation)
Microsoft Windows Server 2016
Microsoft Windows 10 for x64-based Systems
Microsoft Windows 10 for 32-bit Systems
Microsoft Windows 10 22H2 for x64-based Systems
Microsoft Windows 10 22H2 for ARM64-based Systems
Microsoft Windows 10 22H2 for 32-bit Systems
Microsoft Windows 10 21H2 for x64-based Systems
Microsoft Windows 10 21H2 for ARM64-based Systems
Microsoft Windows 10 21H2 for 32-bit Systems
Microsoft Windows 10 1809 for x64-based Systems
Microsoft Windows 10 1809 for 32-bit Systems
Microsoft Windows 10 1607 for x64-based Systems
Microsoft Windows 10 1607 for 32-bit Systems
Microsoft Windows 11 24H2 for x64-based Systems
Microsoft Windows 11 24H2 for ARM64-based Systems
Microsoft Windows 11 23H2 for x64-based Systems
Microsoft Windows 11 23H2 for ARM64-based Systems
Microsoft Windows 11 22H2 for x64-based Systems
Microsoft Windows 11 22H2 for ARM64-based Systems
四、修复建议：
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21299
4 Microsoft Windows Search Service权限提升漏洞（CVE-2025-21292）
一、漏洞描述：
Microsoft Windows Search Service是一个桌面搜索平台，提供针对大部分常见的文件类型和数据类型的即时搜索功能。Microsoft Windows Search Service存在权限提升漏洞，攻击者可利用该漏洞提升权限。
二、风险等级：
高
三、影响范围：
Microsoft Windows Server 2025 (Server Core installation)
Microsoft Windows Server 2025
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
Microsoft Windows Server 2022 (Server Core installation)
Microsoft Windows Server 2022
Microsoft Windows Server 2019 (Server Core installation)
Microsoft Windows Server 2019
Microsoft Windows 10 22H2 for x64-based Systems
Microsoft Windows 10 22H2 for ARM64-based Systems
Microsoft Windows 10 22H2 for 32-bit Systems
Microsoft Windows 10 21H2 for x64-based Systems
Microsoft Windows 10 21H2 for ARM64-based Systems
Microsoft Windows 10 21H2 for 32-bit Systems
Microsoft Windows 10 1809 for x64-based Systems
Microsoft Windows 10 1809 for 32-bit Systems
Microsoft Windows 10 1607 for x64-based Systems
Microsoft Windows 10 1607 for 32-bit Systems
Microsoft Windows 11 24H2 for x64-based Systems
Microsoft Windows 11 24H2 for ARM64-based Systems
Microsoft Windows 11 23H2 for x64-based Systems
Microsoft Windows 11 23H2 for ARM64-based Systems
Microsoft Windows 11 22H2 for x64-based Systems
Microsoft Windows 11 22H2 for ARM64-based Systems
四、修复建议：
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21292
页:
[1]