最新動態

服務公告

  • 關于處理“memcached漏洞”的緊急防護通知

    關于處(chu)(chu)理“memcached漏洞”的(de)(de)(de)(de)(de)緊(jin)急(ji)防(fang)護通知 ??尊敬的(de)(de)(de)(de)(de)客(ke)戶(hu)： ??您好(hao)，接網(wang)安(an)局緊(jin)急(ji)通知：近(jin)日(ri)，利(li)用(yong)memcached服(fu)務(wu)(wu)器實施反(fan)射(she)(she)DDOS攻(gong)(gong)(gong)擊(ji)的(de)(de)(de)(de)(de)事(shi)件呈大幅上(shang)升(sheng)趨勢。國(guo)家計算(suan)機(ji)網(wang)絡(luo)應急(ji)技術(shu)處(chu)(chu)理協調中心（CNCERT）監測發現，memcached反(fan)射(she)(she)攻(gong)(gong)(gong)擊(ji)自(zi)2月(yue)21日(ri)開始在我國(guo)境內活躍，3月(yue)1日(ri)的(de)(de)(de)(de)(de)攻(gong)(gong)(gong)擊(ji)流(liu)量(liang)(liang)已(yi)超過傳統反(fan)射(she)(she)攻(gong)(gong)(gong)擊(ji)SSDP和(he)NTP的(de)(de)(de)(de)(de)攻(gong)(gong)(gong)擊(ji)流(liu)量(liang)(liang)，3月(yue)1日(ri)凌晨2點30分左右峰(feng)值流(liu)量(liang)(liang)高達1.94Tbps。 ??隨著memcached反(fan)射(she)(she)攻(gong)(gong)(gong)擊(ji)方(fang)式被(bei)(bei)黑(hei)客(ke)了解和(he)掌(zhang)握，如(ru)果客(ke)戶(hu)服(fu)務(wu)(wu)器默認開放UDP協議且未做訪問控(kong)制(zhi)，在運行Memcached服(fu)務(wu)(wu)時可能會被(bei)(bei)黑(hei)客(ke)利(li)用(yong)，導致(zhi)流(liu)出方(fang)向的(de)(de)(de)(de)(de)帶(dai)寬消耗或CPU資(zi)源消耗。 ??處(chu)(chu)置建(jian)議： 1）在memcached服(fu)務(wu)(wu)器或者其(qi)上(shang)聯的(de)(de)(de)(de)(de)網(wang)絡(luo)設備上(shang)配置防(fang)火墻策略，僅允許授權(quan)的(de)(de)(de)(de)(de)業務(wu)(wu)IP地址(zhi)訪問memcached服(fu)務(wu)(wu)器，攔截非法的(de)(de)(de)(de)(de)非法訪問。 2）更改memcached服(fu)務(wu)(wu)的(de)(de)(de)(de)(de)監聽端口為11211之外的(de)(de)(de)(de)(de)其(qi)他大端口，避(bi)免針對默認端口的(de)(de)(de)(de)(de)惡意利(li)用(yong)。 3）升(sheng)級到最新的(de)(de)(de)(de)(de)memcached軟件版本，配置啟(qi)用(yong)SASL認證(zheng)等權(quan)限(xian)控(kong)制(zhi)策略（在編譯(yi)安(an)裝memcached程序(xu)時添加(jia)-enable-sasl選項，并且在啟(qi)動(dong)memcached服(fu)務(wu)(wu)程序(xu)時添加(jia)-S參數，啟(qi)用(yong)SASL認證(zheng)機(ji)制(zhi)以(yi)提(ti)升(sheng)memcached的(de)(de)(de)(de)(de)安(an)全(quan)性）。 ??????無錫(xi)華云數據技術(shu)服(fu)務(wu)(wu)有限(xian)公司 ?????? 二零(ling)一八(ba)年三月(yue) 

    2018-08-14

  • CVE-2017-7494:Samba遠程代碼執行漏洞

    CVE-2017-7494:Samba遠程(cheng)代(dai)碼執行(xing)(xing)漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong) ??????2017年(nian)5月24日，著名的(de)文(wen)件(jian)服(fu)務軟件(jian)Samba發布(bu)了(le)(le)4.6.4版本(ben)(ben)，修(xiu)(xiu)(xiu)復(fu)了(le)(le)一(yi)個存在(zai)(zai)長達7年(nian)嚴重(zhong)的(de)遠程(cheng)代(dai)碼執行(xing)(xing)漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)，漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)編號為(wei)CVE-2017-7494，漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)影(ying)(ying)響了(le)(le)Samba 3.5.0之(zhi)前(qian)的(de)所(suo)有版本(ben)(ben)和4.6.4、4.5.10、4.4.14中(zhong)間的(de)版本(ben)(ben)。 　 ??????為(wei)了(le)(le)確保您(nin)的(de)服(fu)務器不被入侵而導(dao)致數據泄露或業(ye)務中(zhong)斷，強烈建(jian)議您(nin)關(guan)注并自查修(xiu)(xiu)(xiu)復(fu)漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)。 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)詳情(qing) 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)編號: CVE-2017-7494 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)名稱: Samba遠程(cheng)代(dai)碼執行(xing)(xing)漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong) 官方評級: 高(gao)危(wei) 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)描述: 該漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)需要通過一(yi)個可(ke)(ke)寫入的(de)Samba用(yong)(yong)(yong)戶(hu)(hu)權(quan)限就可(ke)(ke)以提(ti)權(quan)到samba所(suo)在(zai)(zai)服(fu)務器的(de)root權(quan)限（samba默認是(shi)root用(yong)(yong)(yong)戶(hu)(hu)執行(xing)(xing)的(de)）,該漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)影(ying)(ying)響了(le)(le)Samba 3.5.0之(zhi)前(qian)所(suo)有版本(ben)(ben)和包括4.6.4/4.5.10/4.4.14中(zhong)間的(de)版本(ben)(ben)。 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)利(li)用(yong)(yong)(yong)條件(jian)和方式(shi): 直接遠程(cheng)利(li)用(yong)(yong)(yong) 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)影(ying)(ying)響范圍(wei): Samba 3.5.0之(zhi)前(qian)所(suo)有版本(ben)(ben)、4.6.4、4.5.10、4.4.14 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)檢測: 檢測在(zai)(zai)用(yong)(yong)(yong)Samba是(shi)否在(zai)(zai)受影(ying)(ying)響版本(ben)(ben)內 漏(lou)(lou)(lou)(lou)洞(dong)(dong)(dong)修(xiu)(xiu)(xiu)復(fu)建(jian)議(或緩(huan)解(jie)措施): 緩(huan)解(jie)措施：用(yong)(yong)(yong)戶(hu)(hu)可(ke)(ke)以通過在(zai)(zai)smb.conf的(de)[global]節點(dian)下增加　nt pipe support = no 選項，然后重(zhong)新啟動samba服(fu)務， 以此避免被利(li)用(yong)(yong)(yong) 根治措施： 使用(yong)(yong)(yong)源(yuan)碼安(an)裝的(de)Samba用(yong)(yong)(yong)戶(hu)(hu)，請盡快下載最(zui)新的(de)Samba版本(ben)(ben)手動更(geng)新；使用(yong)(yong)(yong)二進(jin)制分發包（RPM等方式(shi)）的(de)用(yong)(yong)(yong)戶(hu)(hu)立即進(jin)行(xing)(xing)yum，apt-get update等安(an)全(quan)更(geng)新操作。 情(qing)報(bao)來源(yuan): //www.samba.org/samba/security/CVE-2017-7494.html //www.reddit.com/r/netsec/comments/6d0tfx/samba_cve20177494_remote_code_execution_from_a/

    2018-08-14

  • 【漏洞預警】CVE-2017-1000367:Sudo本地提權漏洞

    【漏(lou)(lou)(lou)洞(dong)(dong)(dong)預(yu)警】CVE-2017-1000367:Sudo本(ben)(ben)(ben)地(di)提權漏(lou)(lou)(lou)洞(dong)(dong)(dong) ??????2017年(nian)5月30日,國外安(an)全(quan)研(yan)究(jiu)人員(yuan)發(fa)現(xian)Linux環(huan)節下(xia)(xia)，可以通過sudo實現(xian)本(ben)(ben)(ben)地(di)提權漏(lou)(lou)(lou)洞(dong)(dong)(dong)，漏(lou)(lou)(lou)洞(dong)(dong)(dong)編(bian)號(hao)為(wei)CVE-2017-1000367，該漏(lou)(lou)(lou)洞(dong)(dong)(dong)幾乎影響了(le)所有(you)Linux系(xi)統(tong)(tong)。 具體(ti)詳情(qing)如下(xia)(xia): 漏(lou)(lou)(lou)洞(dong)(dong)(dong)編(bian)號(hao): CVE-2017-1000367 漏(lou)(lou)(lou)洞(dong)(dong)(dong)名稱: Sudo本(ben)(ben)(ben)地(di)提權漏(lou)(lou)(lou)洞(dong)(dong)(dong) 官(guan)方(fang)(fang)評級(ji): 高危(wei) 漏(lou)(lou)(lou)洞(dong)(dong)(dong)描述: 當確定tty時，Sudo沒有(you)正確解(jie)(jie)析(xi)/ proc / [pid] / stat的內容(rong)，本(ben)(ben)(ben)地(di)攻擊(ji)者可能會使(shi)用此方(fang)(fang)法(fa)(fa)來(lai)覆蓋(gai)文(wen)件(jian)系(xi)統(tong)(tong)上的任何文(wen)件(jian)，從而繞過預(yu)期權限或(huo)獲取root shell。 漏(lou)(lou)(lou)洞(dong)(dong)(dong)利(li)用條件(jian)和方(fang)(fang)式: 本(ben)(ben)(ben)地(di)利(li)用 漏(lou)(lou)(lou)洞(dong)(dong)(dong)影響范圍: Sudo 1.8.6p7 到 1.8.20 Red Hat Enterprise Linux 6 (sudo) Red Hat Enterprise Linux 7 (sudo) Red Hat Enterprise Linux Server (v. 5 ELS) (sudo) Debian wheezy Debian jessie Debian stretch Debian sid Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenSuse 漏(lou)(lou)(lou)洞(dong)(dong)(dong)檢(jian)測: 可以使(shi)用以下(xia)(xia)命(ming)(ming)令查(cha)看sudo版本(ben)(ben)(ben): sudo -V 漏(lou)(lou)(lou)洞(dong)(dong)(dong)修復建議(yi)(yi)(或(huo)緩(huan)解(jie)(jie)措施): 目前部分(fen)軟件(jian)源已(yi)經(jing)同步更新（請參考(kao)各廠商公告），也可以通過以下(xia)(xia)命(ming)(ming)令更新補丁(ding): Ubuntu/Debian: sudo apt-get update & sudo apt-get upgrade CentOS/RHEL: yum update yum update sudo 注：升(sheng)級(ji)kernel可能會導致服務器無法(fa)(fa)啟動，建議(yi)(yi)您在升(sheng)級(ji)補丁(ding)時排(pai)(pai)除內核升(sheng)級(ji) 打開(kai)/etc/yum.conf ，輸入(ru)： # vi /etc/yum.conf 在[main]段中(zhong)，下(xia)(xia)添加一(yi)行，如下(xia)(xia)： exclude= kernel* //這里假(jia)設是(shi)排(pai)(pai)除內核升(sheng)級(ji) 情(qing)報來(lai)源: //www.openwall.com/lists/oss-security/2017/05/30/16 Ubuntu://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000367.html Redhat://access.redhat.com/security/cve/cve-2017-1000367 Debain://security-tracker.debian.org/tracker/CVE-2017-1000367 SUSE/openSUSE://www.suse.com/security/cve/CVE-2017-1000367.html

    2018-08-14

  • 【重要】Windows系統曝高危漏洞：Windows系統SMB\RDP遠程命令執行漏洞風險通知及修復指引

    【重要】Windows系(xi)(xi)(xi)統(tong)(tong)(tong)曝(pu)高(gao)危漏洞：Windows系(xi)(xi)(xi)統(tong)(tong)(tong)SMB\RDP遠程(cheng)命(ming)令(ling)執行漏洞風險(xian)通知及修復指引 尊敬的(de)(de)用(yong)(yong)(yong)(yong)戶(hu)： ??????近期境外黑客組織公布了一批Windows高(gao)危漏洞及批量利(li)用(yong)(yong)(yong)(yong)工具，利(li)用(yong)(yong)(yong)(yong)該(gai)工具可(ke)對(dui)開(kai)(kai)放(fang)135/137/139/445端(duan)(duan)口的(de)(de)Windows服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)執行任意命(ming)令(ling)，引發(fa)包括主(zhu)機藍屏、被入侵刪除數據等一系(xi)(xi)(xi)列嚴(yan)重后果(guo)。微(wei)(wei)軟官方(fang)已發(fa)布了漏洞補(bu)丁(ding)，但(dan)大量客戶(hu)尚未修補(bu)，風險(xian)極大，為了更好的(de)(de)提升(sheng)云(yun)主(zhu)機的(de)(de)安(an)(an)全(quan)(quan)性，請(qing)(qing)您(nin)務(wu)(wu)(wu)(wu)(wu)必留意以(yi)下信息： ??????針對(dui)使用(yong)(yong)(yong)(yong)中的(de)(de)windows操(cao)作(zuo)系(xi)(xi)(xi)統(tong)(tong)(tong)服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)，請(qing)(qing)確認服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)的(de)(de)【135、137、139、445】端(duan)(duan)口是否(fou)開(kai)(kai)啟，這(zhe)些(xie)端(duan)(duan)口受本(ben)次漏洞影響，極易導致服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)被入侵。如(ru)果(guo)端(duan)(duan)口有(you)(you)(you)啟用(yong)(yong)(yong)(yong)，請(qing)(qing)注(zhu)意： ??????1、如(ru)果(guo)您(nin)業務(wu)(wu)(wu)(wu)(wu)上(shang)(shang)沒有(you)(you)(you)使用(yong)(yong)(yong)(yong)這(zhe)些(xie)端(duan)(duan)口，請(qing)(qing)您(nin)盡快登(deng)陸登(deng)錄(lu)(lu)(lu)服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)，關閉(bi)這(zhe)些(xie)端(duan)(duan)口，比如(ru)停止(zhi)相(xiang)(xiang)關服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)，開(kai)(kai)啟防火墻或(huo)策(ce)略屏蔽這(zhe)些(xie)端(duan)(duan)口。 ??????2、如(ru)果(guo)您(nin)業務(wu)(wu)(wu)(wu)(wu)上(shang)(shang)有(you)(you)(you)使用(yong)(yong)(yong)(yong)SMB協(xie)議或(huo)以(yi)上(shang)(shang)端(duan)(duan)口，微(wei)(wei)軟已經(jing)發(fa)布公告以(yi)及補(bu)丁(ding)，//blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/ 我們強烈建議您(nin)登(deng)錄(lu)(lu)(lu)服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)安(an)(an)裝更新(xin)(xin)Windows最新(xin)(xin)補(bu)丁(ding)并重啟系(xi)(xi)(xi)統(tong)(tong)(tong)使補(bu)丁(ding)生效。或(huo)者使用(yong)(yong)(yong)(yong)系(xi)(xi)(xi)統(tong)(tong)(tong)自帶windows update功能(neng)進行最新(xin)(xin)補(bu)丁(ding)更新(xin)(xin)并重啟生效。 ??????3、關閉(bi)主(zhu)機智能(neng)卡服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)，防止(zhi)RDP服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)被攻擊(ji)。 ??????windows2008、2012設置(zhi)(zhi)方(fang)法：運行輸入gpedit.msc->計(ji)算機配(pei)置(zhi)(zhi)->管(guan)理模(mo)板->windows組件->智能(neng)卡，然后把設置(zhi)(zhi)列表中帶有(you)(you)(you)“智能(neng)卡”關鍵字的(de)(de)項全(quan)(quan)部設置(zhi)(zhi)為“已禁(jin)用(yong)(yong)(yong)(yong)”。 ??????windows2003設置(zhi)(zhi)方(fang)法：運行輸入gpedit.msc->計(ji)算機配(pei)置(zhi)(zhi)->windows設置(zhi)(zhi)->安(an)(an)全(quan)(quan)設置(zhi)(zhi)->本(ben)地策(ce)略->安(an)(an)全(quan)(quan)選(xuan)項，交互式(shi)登(deng)錄(lu)(lu)(lu)：要求智能(neng)卡設置(zhi)(zhi)為“已禁(jin)用(yong)(yong)(yong)(yong)”，交互式(shi)登(deng)錄(lu)(lu)(lu)：智能(neng)卡移除操(cao)作(zuo)設置(zhi)(zhi)為“鎖定工作(zuo)站”。 ??????接到此通知，請(qing)(qing)您(nin)務(wu)(wu)(wu)(wu)(wu)必引起重視，確認所(suo)使用(yong)(yong)(yong)(yong)windows服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)是否(fou)有(you)(you)(you)開(kai)(kai)啟以(yi)上(shang)(shang)端(duan)(duan)口，如(ru)果(guo)開(kai)(kai)啟請(qing)(qing)立即(ji)進行相(xiang)(xiang)應(ying)處(chu)理，確保您(nin)服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)器(qi)(qi)(qi)的(de)(de)安(an)(an)全(quan)(quan)。 ??????注(zhu)意：修復漏洞前請(qing)(qing)將資料備份(fen)，并進行充分測試(shi)。如(ru)有(you)(you)(you)任何(he)問題，您(nin)可(ke)隨時通過工單系(xi)(xi)(xi)統(tong)(tong)(tong)或(huo)服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)電話4008084000-4聯(lian)系(xi)(xi)(xi)我司咨詢。 ??????無錫(xi)華云(yun)數據技術(shu)服(fu)(fu)(fu)(fu)務(wu)(wu)(wu)(wu)(wu)有(you)(you)(you)限公司 ??????二零一七年四(si)月

    2018-08-14

  • 【高危漏洞預警】Oracle發布多個Java漏洞更新

    【高危(wei)漏(lou)(lou)(lou)洞(dong)(dong)預警】Oracle發(fa)(fa)布多個(ge)(ge)Java漏(lou)(lou)(lou)洞(dong)(dong)更新 2017年(nian)(nian)7月18日，Oracle官方發(fa)(fa)布了(le)2017年(nian)(nian)7月份的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)安全(quan)公(gong)告(gao)(gao)，安全(quan)公(gong)告(gao)(gao)中(zhong)(zhong)(zhong)(zhong)報(bao)告(gao)(gao)了(le)多個(ge)(ge)漏(lou)(lou)(lou)洞(dong)(dong)，遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)訪問(wen)(wen)和(he)(he)修改(gai)(gai)(gai)目標(biao)(biao)系統(tong)上(shang)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)數(shu)(shu)(shu)(shu)據(ju)(ju)，或可(ke)(ke)(ke)以(yi)(yi)(yi)在(zai)目標(biao)(biao)系統(tong)上(shang)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限，或導致(zhi)(zhi)目標(biao)(biao)系統(tong)上(shang)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)拒絕(jue)(jue)服(fu)(fu)務(wu)，本(ben)次公(gong)告(gao)(gao)涉及(ji)到(dao)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)安全(quan)漏(lou)(lou)(lou)洞(dong)(dong)較多，安全(quan)風險較高。 本(ben)次公(gong)告(gao)(gao)發(fa)(fa)布的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)漏(lou)(lou)(lou)洞(dong)(dong)影響(xiang)(xiang)范(fan)圍如下(xia)(xia): Java 6 Update 151 Java 7 Update 141 Java 8 Update 131 漏(lou)(lou)(lou)洞(dong)(dong)編(bian)號: CVE-2017-10053，CVE-2017-10067, CVE-2017-10074, CVE-2017-10078, CVE-2017-10081, CVE-2017-10086, CVE-2017-10087, CVE-2017-10089, CVE-2017-10090, CVE-2017-10096, CVE-2017-10101, CVE-2017-10102, CVE-2017-10104, CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109, CVE-2017-10110, CVE-2017-10111, CVE-2017-10114, CVE-2017-10115, CVE-2017-10116, CVE-2017-10117, CVE-2017-10118, CVE-2017-10121, CVE-2017-10125, CVE-2017-10135, CVE-2017-10145, CVE-2017-10176, CVE-2017-10193, CVE-2017-10198, CVE-2017-10243 漏(lou)(lou)(lou)洞(dong)(dong)名稱: Java多個(ge)(ge)安全(quan)漏(lou)(lou)(lou)洞(dong)(dong) 官方評級: 高危(wei) 漏(lou)(lou)(lou)洞(dong)(dong)描述: Oracle Java SE公(gong)告(gao)(gao)中(zhong)(zhong)(zhong)(zhong)報(bao)告(gao)(gao)了(le)多個(ge)(ge)漏(lou)(lou)(lou)洞(dong)(dong)，具(ju)體參見如下(xia)(xia): 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)AWT組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10110] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)ImageIO組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10089] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)JavaFX組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10086] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)JAXP組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10096] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)JAXP組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10101] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)庫組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10087，CVE-2017-10090，CVE-2017-10111] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)RMI組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10107，CVE-2017-10102] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)JavaFX組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10114] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)熱點組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10074] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)Security組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10116] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)驗證(zheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)腳本(ben)組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)來(lai)訪問(wen)(wen)和(he)(he)修改(gai)(gai)(gai)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10078] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)安全(quan)組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10067] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)JCE組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)來(lai)訪問(wen)(wen)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10115，CVE-2017-10118] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)Security組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)來(lai)訪問(wen)(wen)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10176] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)身(shen)份驗證(zheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)服(fu)(fu)務(wu)器(qi)組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)部(bu)(bu)(bu)(bu)分(fen)訪問(wen)(wen)數(shu)(shu)(shu)(shu)據(ju)(ju)，部(bu)(bu)(bu)(bu)分(fen)修改(gai)(gai)(gai)數(shu)(shu)(shu)(shu)據(ju)(ju)，部(bu)(bu)(bu)(bu)分(fen)拒絕(jue)(jue)服(fu)(fu)務(wu)[CVE-2017-10104，CVE-2017-10145] 本(ben)地用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)部(bu)(bu)(bu)(bu)署(shu)組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)獲(huo)(huo)(huo)得(de)(de)提(ti)(ti)(ti)升(sheng)(sheng)(sheng)(sheng)(sheng)(sheng)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)權(quan)限[CVE-2017-10125] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)Security組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)來(lai)訪問(wen)(wen)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10198] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)JAX-WS組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)部(bu)(bu)(bu)(bu)分(fen)訪問(wen)(wen)數(shu)(shu)(shu)(shu)據(ju)(ju)并導致(zhi)(zhi)部(bu)(bu)(bu)(bu)分(fen)拒絕(jue)(jue)服(fu)(fu)務(wu)條(tiao)件(jian)(jian)(jian)(jian)[CVE-2017-10243] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)服(fu)(fu)務(wu)器(qi)組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)部(bu)(bu)(bu)(bu)分(fen)訪問(wen)(wen)并部(bu)(bu)(bu)(bu)分(fen)修改(gai)(gai)(gai)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10121] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)JCE組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)來(lai)訪問(wen)(wen)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10135] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)服(fu)(fu)務(wu)器(qi)組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)部(bu)(bu)(bu)(bu)分(fen)訪問(wen)(wen)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10117] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)2D組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)導致(zhi)(zhi)部(bu)(bu)(bu)(bu)分(fen)拒絕(jue)(jue)服(fu)(fu)務(wu)條(tiao)件(jian)(jian)(jian)(jian)[CVE-2017-10053] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)序(xu)列化組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)導致(zhi)(zhi)部(bu)(bu)(bu)(bu)分(fen)拒絕(jue)(jue)服(fu)(fu)務(wu)條(tiao)件(jian)(jian)(jian)(jian)[CVE-2017-10108，CVE-2017-10109] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)部(bu)(bu)(bu)(bu)署(shu)組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)部(bu)(bu)(bu)(bu)分(fen)修改(gai)(gai)(gai)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10105] 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)Hotspot組(zu)(zu)(zu)(zu)(zu)件(jian)(jian)(jian)(jian)中(zhong)(zhong)(zhong)(zhong)的(de)(de)(de)(de)(de)(de)(de)(de)(de)(de)缺(que)(que)(que)陷(xian)(xian)(xian)(xian)部(bu)(bu)(bu)(bu)分(fen)修改(gai)(gai)(gai)數(shu)(shu)(shu)(shu)據(ju)(ju)[CVE-2017-10081] 漏(lou)(lou)(lou)洞(dong)(dong)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)條(tiao)件(jian)(jian)(jian)(jian)和(he)(he)方式: 遠(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)(yuan)程(cheng)(cheng)(cheng)利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)或本(ben)地利(li)(li)(li)(li)(li)(li)(li)用(yong)(yong)(yong)(yong)(yong)(yong)。 漏(lou)(lou)(lou)洞(dong)(dong)檢測: 開發(fa)(fa)人員自查java版(ban)本(ben)是否在(zai)受(shou)影響(xiang)(xiang)版(ban)本(ben)內。 漏(lou)(lou)(lou)洞(dong)(dong)修復建議(或緩解措施(shi)): 目前(qian)官網(wang)已經(jing)發(fa)(fa)布最新版(ban)本(ben)修復該(gai)漏(lou)(lou)(lou)洞(dong)(dong)，用(yong)(yong)(yong)(yong)(yong)(yong)戶(hu)(hu)(hu)(hu)(hu)(hu)(hu)(hu)可(ke)(ke)(ke)以(yi)(yi)(yi)更新到(dao)Java 8 Update 141。 情報(bao)來(lai)源: Oracle官方公(gong)告(gao)(gao)://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html //www.securitytracker.com/id/1038931 ??????華云數(shu)(shu)(shu)(shu)據(ju)(ju)集團有(you)限公(gong)司 ??????二零一七(qi)年(nian)(nian)七(qi)月

    2018-08-14

  • 【高危漏洞預警】微軟“10月周二補丁日”發布63個漏洞補丁

    【高危漏(lou)洞(dong)預警(jing)】微(wei)軟“10月(yue)周二補丁日(ri)”發布(bu)63個漏(lou)洞(dong)補丁 ??????2017年10月(yue)10日(ri)，微(wei)軟發布(bu)了針(zhen)對各(ge)種(zhong)產品已(yi)被(bei)確認和解決的漏(lou)洞(dong)的每月(yue)安全(quan)建(jian)議(yi)。本月(yue)的安全(quan)公(gong)告解決了63個新(xin)(xin)漏(lou)洞(dong)，其(qi)中28個評(ping)級為(wei)(wei)重(zhong)要(yao)級別，35個評(ping)級為(wei)(wei)重(zhong)要(yao)。 這些漏(lou)洞(dong)影(ying)響圖(tu)形化(hua)功(gong)能(neng)、Edge、Internet Explorer、Office、Sharepoint、Windows圖(tu)形顯(xian)示接(jie)口、Windows內核模式驅動程序等。 漏(lou)洞(dong)影(ying)響范圍: Internet Explorer Microsoft Edge Microsoft Windows Microsoft Office and Microsoft Office Services and Web Apps Skype for Business and Lync Chakra Core 嚴重(zhong)漏(lou)洞(dong)： CVE-2017-11813 - Internet Explorer Memory Corruption Vulnerability CVE-2017-11822 - Internet Explorer Memory Corruption Vulnerability CVE-2017-11762 - Microsoft Graphics Remote Code Execution Vulnerability CVE-2017-11763 - Microsoft Graphics Remote Code Execution Vulnerability CVE-2017-11797 - Scripting Engine Information Disclosure Vulnerability CVE-2017-11767 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11792 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11793 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11796 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11798 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11799 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11800 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11801 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11802 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11804 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11805 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11806 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11807 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11808 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11809 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11810 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11811 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11812 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11821 - Scripting Engine Memory Corruption Vulnerability CVE-2017-11779 - Windows DNSAPI Remote Code Execution Vulnerability CVE-2017-11771 - Windows Search Remote Code Execution Vulnerability CVE-2017-8727 - Windows Shell Memory Corruption Vulnerability CVE-2017-11819 - Windows Shell Remote Code Execution Vulnerability 高危漏(lou)洞(dong)： CVE-2017-11790 - Internet Explorer Information Disclosure Vulnerability CVE-2017-11794 - Microsoft Edge Information Disclosure Vulnerability CVE-2017-8726 - Microsoft Edge Memory Corruption Vulnerability CVE-2017-8693 - Microsoft Graphics Information Disclosure Vulnerability CVE-2017-8717 - Microsoft JET Database Engine Remote Code Execution Vulnerability CVE-2017-8718 - Microsoft JET Database Engine Remote Code Execution Vulnerability CVE-2017-11826 - Microsoft Office Memory Corruption Vulnerability CVE-2017-11825 - Microsoft Office Remote Code Execution Vulnerability CVE-2017-11775 - Microsoft Office SharePoint XSS Vulnerability CVE-2017-11777 - Microsoft Office SharePoint XSS Vulnerability CVE-2017-11820 - Microsoft Office SharePoint XSS Vulnerability CVE-2017-11776 - Microsoft Outlook Information Disclosure Vulnerability CVE-2017-11774 - Microsoft Outlook Security Feature Bypass Vulnerability CVE-2017-11772 - Microsoft Search Information Disclosure Vulnerability CVE-2017-11823 - Microsoft Windows Security Feature Bypass CVE-2017-11786 - Skype for Business Elevation of Privilege Vulnerability CVE-2017-11769 - TRIE Remote Code Execution Vulnerability CVE-2017-8689 - Win32k Elevation of Privilege Vulnerability CVE-2017-8694 - Win32k Elevation of Privilege Vulnerability CVE-2017-11783 - Windows Elevation of Privilege Vulnerability CVE-2017-11816 - Windows GDI Information Disclosure Vulnerability CVE-2017-11824 - Windows Graphics Component Elevation of Privilege Vulnerability CVE-2017-11817 - Windows Information Disclosure Vulnerability CVE-2017-11765 - Windows Kernel Information Disclosure Vulnerability CVE-2017-11784 - Windows Kernel Information Disclosure Vulnerability CVE-2017-11785 - Windows Kernel Information Disclosure Vulnerability CVE-2017-11814 - Windows Kernel Information Disclosure Vulnerability CVE-2017-8715 - Windows Security Feature Bypass Vulnerability CVE-2017-11781 - Windows SMB Denial of Service Vulnerability CVE-2017-11782 - Windows SMB Elevation of Privilege Vulnerability CVE-2017-11815 - Windows SMB Information Disclosure Vulnerability CVE-2017-11780 - Windows SMB Remote Code Execution Vulnerability CVE-2017-11818 - Windows Storage Security Feature Bypass Vulnerability CVE-2017-8703 - Windows Subsystem for Linux Denial of Service Vulnerability CVE-2017-11829 - Windows Update Delivery Optimization Elevation of Privilege Vulnerability 安全(quan)建(jian)議(yi): ??????友(you)情(qing)提(ti)示華云數(shu)(shu)據(ju)(ju)用戶(hu)關注，并根據(ju)(ju)業務(wu)情(qing)況(kuang)(kuang)及(ji)時(shi)更(geng)(geng)新(xin)(xin)補丁，以提(ti)高服務(wu)器安全(quan)性。 ??????1.建(jian)議(yi)用戶(hu)打(da)開Windows Update功(gong)能(neng)，然(ran)后點(dian)擊(ji)“檢查(cha)更(geng)(geng)新(xin)(xin)”按鈕，根據(ju)(ju)業務(wu)情(qing)況(kuang)(kuang)下(xia)載(zai)安裝(zhuang)相關安全(quan)補丁; ??????2.安裝(zhuang)完畢后重(zhong)啟(qi)服務(wu)器，檢查(cha)系統(tong)運行情(qing)況(kuang)(kuang)。 注意： ??????在更(geng)(geng)新(xin)(xin)安裝(zhuang)升級前，建(jian)議(yi)做好(hao)測試工作，并務(wu)必做好(hao)數(shu)(shu)據(ju)(ju)備份和快照，防止出現意外。 ??????如有(you)(you)任何問題，可隨時(shi)通過(guo)工單或服務(wu)電話4008084000-4聯系反饋。 ??????華云數(shu)(shu)據(ju)(ju)集團有(you)(you)限公(gong)司 ??????二零一七(qi)年十(shi)月(yue)

    2018-08-14

  • 政策法規提醒通告

    政(zheng)策、法規提(ti)醒通(tong)告關于海外服(fu)務(wu)器違規開(kai)展跨(kua)境業務(wu)的提(ti)醒通(tong)告關于進一步加強未備案網站管理工作的通(tong)知

    2018-08-14

  • 關于海外服務器違規開展跨境業務的提醒通告

    關于海外(wai)服(fu)(fu)務(wu)(wu)器(qi)違(wei)規(gui)開展跨境業(ye)務(wu)(wu)的提(ti)醒(xing)通(tong)告 尊敬(jing)的華云用戶： ??????您好(hao)！首先感謝(xie)您一直(zhi)以來(lai)對華云數據的支持！ ??????接上(shang)級主管(guan)單位(wei)通(tong)報，如您海外(wai)的主機(ji)通(tong)過技(ji)術手段成(cheng)為(wei)境內(nei)獲取境外(wai)《互聯網信息服(fu)(fu)務(wu)(wu)管(guan)理(li)辦法》之九(jiu)不準類(lei)違(wei)規(gui)信息的途(tu)徑或內(nei)容，請您立即停止服(fu)(fu)務(wu)(wu)器(qi)上(shang)的相關技(ji)術服(fu)(fu)務(wu)(wu)或內(nei)容。否則可能導致服(fu)(fu)務(wu)(wu)器(qi)IP被封禁，請您知曉并妥善處置。 ??????如有疑(yi)問，請咨詢我司(si)7*24小時服(fu)(fu)務(wu)(wu)熱線：400-808-4000-4或在(zai)客服(fu)(fu)中心提(ti)交工單。 ??????華云數據集團有限公司(si) ??????二零(ling)一七年(nian)七月

    2018-08-14

  • 關于進一步加強未備案網站管理工作的通知

    關于進一(yi)(yi)步加(jia)強(qiang)未(wei)(wei)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)管(guan)理工(gong)作的(de)(de)通(tong)知 尊敬的(de)(de)華(hua)(hua)云用戶： ??????您好！首先感謝(xie)您一(yi)(yi)直以來對華(hua)(hua)云數(shu)據的(de)(de)支持(chi)！ ??????近期工(gong)信(xin)(xin)(xin)部(bu)(bu)對境(jing)(jing)內(nei)未(wei)(wei)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)情況(kuang)(kuang)進行了摸底(di)排查(cha)，發現(xian)接(jie)入服(fu)(fu)務(wu)(wu)(wu)(wu)企業(ye)普遍存(cun)(cun)在未(wei)(wei)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)接(jie)入的(de)(de)情況(kuang)(kuang)。要求(qiu)(qiu)我司(si)(si)(si)加(jia)強(qiang)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)管(guan)理，進一(yi)(yi)步開展打擊未(wei)(wei)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)的(de)(de)工(gong)作。 ??????請貴司(si)(si)(si)立(li)即(ji)開展自查(cha)自糾工(gong)作，如已(yi)上線的(de)(de)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)存(cun)(cun)在沒有(you)ICP備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)的(de)(de)情況(kuang)(kuang)，請立(li)即(ji)關閉網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)并取(qu)消域(yu)名解析(xi)，待ICP備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)通(tong)過后再開通(tong)運營(ying)(ying)。 ??????后續我司(si)(si)(si)會(hui)嚴格按照通(tong)管(guan)局(ju)規(gui)(gui)定加(jia)強(qiang)監控，一(yi)(yi)經(jing)(jing)發現(xian)有(you)未(wei)(wei)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)接(jie)入的(de)(de)情況(kuang)(kuang)，我司(si)(si)(si)將(jiang)立(li)即(ji)關閉主機(ji)，待用戶按要求(qiu)(qiu)整改后再申(shen)請解封。 ??????強(qiang)調：部(bu)(bu)分機(ji)房此(ci)情況(kuang)(kuang)封閉IP后無法(fa)(fa)申(shen)請解封，具體以我司(si)(si)(si)關閉通(tong)知信(xin)(xin)(xin)為(wei)準。 ??????法(fa)(fa)律法(fa)(fa)規(gui)(gui)：依據《非經(jing)(jing)營(ying)(ying)性(xing)互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)服(fu)(fu)務(wu)(wu)(wu)(wu)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)管(guan)理辦法(fa)(fa)》 ??????第(di)五條(tiao) ：在中(zhong)(zhong)(zhong)華(hua)(hua)人民(min)共(gong)和(he)(he)國(guo)(guo)境(jing)(jing)內(nei)提(ti)(ti)供(gong)非經(jing)(jing)營(ying)(ying)性(xing)互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)服(fu)(fu)務(wu)(wu)(wu)(wu)，應(ying)當(dang)(dang)依法(fa)(fa)履行備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)手(shou)續。未(wei)(wei)經(jing)(jing)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)，不得在中(zhong)(zhong)(zhong)華(hua)(hua)人民(min)共(gong)和(he)(he)國(guo)(guo)境(jing)(jing)內(nei)從事非經(jing)(jing)營(ying)(ying)性(xing)互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)服(fu)(fu)務(wu)(wu)(wu)(wu)。本辦法(fa)(fa)所稱在中(zhong)(zhong)(zhong)華(hua)(hua)人民(min)共(gong)和(he)(he)國(guo)(guo)境(jing)(jing)內(nei)提(ti)(ti)供(gong)非經(jing)(jing)營(ying)(ying)性(xing)互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)服(fu)(fu)務(wu)(wu)(wu)(wu)，是指(zhi)在中(zhong)(zhong)(zhong)華(hua)(hua)人民(min)共(gong)和(he)(he)國(guo)(guo)境(jing)(jing)內(nei)的(de)(de)組織或個人利(li)用通(tong)過互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)域(yu)名訪(fang)問的(de)(de)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)或者利(li)用僅能通(tong)過互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)IP 地址訪(fang)問的(de)(de)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)站(zhan)(zhan)，提(ti)(ti)供(gong)非經(jing)(jing)營(ying)(ying)性(xing)互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)服(fu)(fu)務(wu)(wu)(wu)(wu)。 ??????第(di)十九條(tiao) ：互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)接(jie)入服(fu)(fu)務(wu)(wu)(wu)(wu)提(ti)(ti)供(gong)者應(ying)當(dang)(dang)記錄其接(jie)入的(de)(de)非經(jing)(jing)營(ying)(ying)性(xing)互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)服(fu)(fu)務(wu)(wu)(wu)(wu)提(ti)(ti)供(gong)者的(de)(de)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)。 ??????法(fa)(fa)律法(fa)(fa)規(gui)(gui)詳細信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)點此(ci)查(cha)看： 《非經(jing)(jing)營(ying)(ying)性(xing)互(hu)(hu)聯(lian)網(wang)(wang)(wang)(wang)(wang)(wang)(wang)(wang)信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)服(fu)(fu)務(wu)(wu)(wu)(wu)備(bei)(bei)(bei)(bei)案(an)(an)(an)(an)管(guan)理辦法(fa)(fa)》(信(xin)(xin)(xin)息(xi)(xi)(xi)(xi)(xi)產(chan)業(ye)部(bu)(bu)令第(di)33號) ??????具體通(tong)知如下： //www.miit.gov.cn/newweb/n1146285/n1146352/n3054355/n3057709/n3057722/c5717035/content.html ??????華(hua)(hua)云數(shu)據集團(tuan)有(you)限公司(si)(si)(si) ??????二零一(yi)(yi)七年(nian)七月

    2018-08-14