2019年8月14日微软官方发布安全补丁，修复了两个Windows远程桌面服务的远程代码执行漏洞CVE-2019-1181/CVE-2019-1182，这两个漏洞影响了几乎目前所有受支持的Windows系统。

CNVD对该漏洞的综合评级为“高危”，建议用户立即进行补丁更新处理。

 影响范围

• Windows 10 for 32-bit Systems

• Windows 10 for x64-based Systems

• Windows 10 Version 1607 for 32-bit Systems

• Windows 10 Version 1607 for x64-based Systems

• Windows 10 Version 1703 for 32-bit Systems

• Windows 10 Version 1703 for x64-based Systems

• Windows 10 Version 1709 for 32-bit Systems

• Windows 10 Version 1709 for 64-based Systems

• Windows 10 Version 1709 for ARM64-based Systems

• Windows 10 Version 1803 for 32-bit Systems

• Windows 10 Version 1803 for ARM64-based Systems

• Windows 10 Version 1803 for x64-based Systems

• Windows 10 Version 1809 for 32-bit Systems

• Windows 10 Version 1809 for ARM64-based Systems

• Windows 10 Version 1809 for x64-based Systems

• Windows 10 Version 1903 for 32-bit Systems

• Windows 10 Version 1903 for ARM64-based Systems

• Windows 10 Version 1903 for x64-based Systems

• Windows 7 for 32-bit Systems Service Pack 1

• Windows 7 for x64-based Systems Service Pack 1

• Windows 8.1 for 32-bit systems

• Windows 8.1 for x64-based systems

• Windows RT 8.1

• Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1

• Windows Server 2008 R2 for x64-based Systems Service Pack 1

• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

• Windows Server 2012

• Windows Server 2012 (Server Core installation)

• Windows Server 2012 R2

• Windows Server 2012 R2 (Server Core installation)

• Windows Server 2016

• Windows Server 2016 (Server Core installation)

• Windows Server 2019

• Windows Server 2019 (Server Core installation)

• Windows Server, version 1803 (Server Core Installation)

• Windows Server, version 1903 (Server Core installation)

注意：对于使用Windows 7 Service Pack 1或者Windows Server 2008 R2 Service Pack 1的用户，只有安装了RDP 8.0或RDP 8.1，这些操作系统才会受到此漏洞的影响。

Windows XP，Windows Server 2003和Windows Server 2008不受此漏洞的影响，并且远程桌面协议（RDP）不受影响。

临时修复建议

• 关闭企业边界防火墙上的TCP端口3389
• 如果系统上不再需要这些服务，可以考虑禁用
• 在受支持的Windows 7、Windows Server 2008和Windows Server 2008 R2版本的系统上启用网络身份验证(NLA)，这使得攻击者首先需要使用目标系统上的有效帐户对远程桌面服务进行身份验证然后才能利用该漏洞

漏洞处置建议

目前，微软官方已发布补丁修复此漏洞，建议用户将相关系统版本立即升级至最新版本：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1181

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1182

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1222

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1226