安天应对微软SMB漏洞（CVE-2017-11780）响应手册

安天安全研究与应急处理中心(Antiy CERT)

初稿完成时间：2017年10月12日12时00分

首次发布时间：2017年10月12日12时00分

一、概述

近日，国家信息安全漏洞共享平台（CNVD）收录了Microsoft Windows SMB Server远程代码执行漏洞（CNVD-2017-29681，对应CVE-2017-11780）。远程攻击者成功利用漏洞可允许在目标系统上执行任意代码，如果利用失败将导致拒绝服务。CNVD对该漏洞的综合评级为“高危”。综合业内各方研判情况，该漏洞影响版本范围跨度大，一旦漏洞细节披露，将造成极为广泛的攻击威胁，或可诱发APT攻击，安天提醒用户警惕出现“WannaCry”蠕虫翻版，建议根据本手册中“受影响系统版本”和“微软官方补丁编号”及时做好漏洞排查和处置工作。

二、受影响系统版本

微软产品系列	具体版本
Microsoft Windows 7	x32-bit Systems SP1 x64-bit Systems SP1
Microsoft Windows 8.1	x32-bit Systems x64-bit Systems
Microsoft Windows RT 8.1
Microsoft Windows 10	for x32-bit Systems for x64-bit Systems Version 1511 for x32-bit Systems Version 1511 for x64-bit Systems Version 1607 for x32-bit Systems Version 1607 for x64-bit Systems Version 1703 for x32-bit Systems Version 1703 for x64-bit Systems
Microsoft Windows Server 2008	R2 for Itanium-based Systems SP1 R2 for x64-bit Systems SP1 x32-bit Systems SP2 x64-bit Systems SP2 Itanium-based Systems SP2
Microsoft Windows Windows Server 2012 Microsoft Windows Server 2012 R2
Microsoft Windows Server 2016

三、防护解决方案

3.1 安装微软官方补丁

用户可根据系统安装补丁编号排查是否已经安装官方补丁。

Win7系统操作如下：开始—>控制面板—>Windows Update—>查看更新历史记录。

Win10系统操作如下：Windows设置—>更新和安全—>历史更新记录（如下图）。

不同系统版本微软官方补丁编号、参考链接如下表（安全更新是本次漏洞单独补丁、月度累积更新是补丁集合含本次漏洞补丁）：

微软产系统版本	补丁编号（KB***）和链接
Windows 10 for 32-bit Systems	https://www.catalog.update.microsoft.com/Search.aspx?q=KB4042895（安全更新）
Windows 10 for x64-based Systems
Windows 10 Version 1511 for 32-bit Systems	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041689（安全更新）
Windows 10 Version 1511 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041691（安全更新）
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1703 for 32-bit Systems	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041676（安全更新）
Windows 10 Version 1703 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1	https://www.catalog.update.microsoft.com/Search.aspx?q=KB4041681（月度累积更新） https://www.catalog.update.microsoft.com/Search.aspx?q=KB4041678 （安全更新）
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems	https://www.catalog.update.microsoft.com/Search.aspx?q=KB4041693（月度累积更新） https://www.catalog.update.microsoft.com/Search.aspx?q=KB4041687 （安全更新）
Windows 8.1 for x64-based systems
Windows RT 8.1	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041693（月度累积更新）
Windows Server 2008 for 32-bit Systems Service Pack 2	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041995（安全更新）
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041681（月度累积更新） https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041678（安全更新）
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041690（月度累积更新） https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041679（安全更新）
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041693（月度累积更新） https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041687（安全更新）
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016	https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041691（安全更新）
Windows Server 2016 (Server Core installation)