ÐÅÏ¢Çå¾²Öܱ¨-2018ÄêµÚ28ÖÜ
Ðû²¼Ê±¼ä 2018-07-16Ò»¡¢±¾ÖÜÇå¾²Ì¬ÊÆ×ÛÊö
2018Äê07ÔÂ09ÈÕÖÁ15ÈÕ¹²ÊÕ¼Çå¾²Îó²î63¸ö£¬£¬£¬£¬£¬£¬ÖµµÃ¹Ø×¢µÄÊÇMicrosoft Edge Chakra¾ç±¾ÒýÇæÔ¶³ÌÄÚ´æÆÆËðÎó²î£»£»£»Microsoft Skype for Business CVE-2018-8311Ô¶³Ì´úÂëÖ´ÐÐÎó²î£»£»£»Adobe Acrobat/Reader CVE-2018-4888ÊͷźóʹÓôúÂëÖ´ÐÐÎó²î£»£»£»TP-Link TL-WR841N CVE-2018-12577ÏÂÁî×¢ÈëÎó²î£»£»£»Desdev DedeCMSí§ÒâÎļþÉÏ´«Îó²î¡£¡£¡£¡£
±¾ÖÜÖµµÃ¹Ø×¢µÄÍøÂçÇå¾²ÊÂÎñÊÇÃÀ¹ú¿¨Ë¹µØÇøµÄÒ½ÁÆÖÐÐÄÔ⵽δ֪ÀÕË÷Èí¼þµÄ¹¥»÷£»£»£»VSDC¹ÙÍø1¸öÔÂÄÚÈý´ÎÔâºÚ¿ÍÈëÇÖ£¬£¬£¬£¬£¬£¬ÆäÈí¼þÏÂÔØÁ´½Ó±»Ð®ÖÆ£»£»£»Chrome²å¼þHola VPNÔ⺧£¬£¬£¬£¬£¬£¬Ô²å¼þ±»Ö²Èë¶ñÒâ´úÂ룻£»£»TimehopÔâºÚ¿ÍÈëÇÖ£¬£¬£¬£¬£¬£¬Áè¼Ý2100ÍòÓû§µÄÊý¾Ýй¶£»£»£»Domain FactoryÈ·ÈÏÔÚ1Ô·ÝÔâºÚ¿ÍÈëÇÖ£¬£¬£¬£¬£¬£¬²¿·ÖÓû§µÄÊý¾Ýй¶¡£¡£¡£¡£
ƾ֤ÒÔÉÏ×ÛÊö£¬£¬£¬£¬£¬£¬±¾ÖÜÇå¾²ÍþвΪÖС£¡£¡£¡£
¶þ¡¢Ö÷ÒªÇå¾²Îó²îÁбí
1¡¢Microsoft Edge Chakra¾ç±¾ÒýÇæÔ¶³ÌÄÚ´æÆÆËðÎó²î
Microsoft EdgeChakra¾ç±¾ÒýÇæÃ»ÓÐ׼ȷµÄ´¦Öóͷ£ÄÚ´æÖеŤ¾ß£¬£¬£¬£¬£¬£¬ÔÊÐíÔ¶³Ì¹¥»÷ÕßʹÓÃÎó²îÌá½»ÌØÊâµÄWEBÒ³ÇëÇ󣬣¬£¬£¬£¬£¬ÓÕʹÓû§ÆÊÎö£¬£¬£¬£¬£¬£¬¿ÉÒÔÓ¦ÓóÌÐòÉÏÏÂÎÄÖ´ÐÐí§Òâ´úÂë¡£¡£¡£¡£
Óû§¿É²Î¿¼Èçϳ§ÉÌÌṩµÄÇå¾²²¹¶¡ÒÔÐÞ¸´¸ÃÎó²î£º
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8294
2¡¢Microsoft Skype for Business CVE-2018-8311Ô¶³Ì´úÂëÖ´ÐÐÎó²î
Microsoft Skype for Business 2016ûÓÐ׼ȷµÄ¹ýÂËÌØÖÆµÄÄÚÈÝ£¬£¬£¬£¬£¬£¬ÔÊÐíÔ¶³Ì¹¥»÷ÕßʹÓÃÎó²îÌá½»ÌØÊâµÄÇëÇ󣬣¬£¬£¬£¬£¬ÒÔÓ¦ÓóÌÐòÉÏÏÂÎÄÖ´ÐÐí§Òâ´úÂë¡£¡£¡£¡£
Óû§¿É²Î¿¼Èçϳ§ÉÌÌṩµÄÇå¾²²¹¶¡ÒÔÐÞ¸´¸ÃÎó²î£º
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8311
3¡¢Adobe Acrobat/Reader CVE-2018-4888ÊͷźóʹÓôúÂëÖ´ÐÐÎó²î
Adobe Acrobat/Reader XFAÒýÇæÊµÏÖ±£´æÊͷźóʹÓÃÎó²î£¬£¬£¬£¬£¬£¬ÔÊÐíÔ¶³Ì¹¥»÷ÕßʹÓÃÎó²îÌá½»ÌØÊâµÄÎļþÇëÇ󣬣¬£¬£¬£¬£¬ÓÕʹÓû§ÆÊÎö£¬£¬£¬£¬£¬£¬¿ÉÒÔÓ¦ÓóÌÐòÉÏÏÂÎÄÖ´ÐÐí§Òâ´úÂë¡£¡£¡£¡£
Óû§¿É²Î¿¼Èçϳ§ÉÌÌṩµÄÇå¾²²¹¶¡ÒÔÐÞ¸´¸ÃÎó²î£ºhttps://helpx.adobe.com/security/products/acrobat/apsb18-02.html
4¡¢TP-Link TL-WR841N CVE-2018-12577ÏÂÁî×¢ÈëÎó²î
TP-Link TL-WR841N Ping¼°Traceroute¹¦Ð§±£´æÊäÈëÑéÖ¤Îó²î£¬£¬£¬£¬£¬£¬ÔÊÐíÔ¶³Ì¹¥»÷Õß¿ÉÒÔʹÓÃÎó²îÌá½»ÌØÊâµÄÇëÇ󣬣¬£¬£¬£¬£¬ÒÔÓ¦ÓóÌÐòÉÏÏÂÎÄÖ´ÐÐí§ÒâÏÂÁî¡£¡£¡£¡£
Óû§¿É²Î¿¼Èçϳ§ÉÌÌṩµÄÇå¾²²¹¶¡ÒÔÐÞ¸´¸ÃÎó²î£ºhttps://software-talk.org/blog/2018/06/tplink-wr841n-code-exec-cve-2018-12577/
5¡¢Desdev DedeCMSí§ÒâÎļþÉÏ´«Îó²î
DedeCMS dede/file_manage_control.phpÎļþ±£´æÇå¾²Îó²î£¬£¬£¬£¬£¬£¬ÔÊÐíÔ¶³Ì¹¥»÷Õß¿ÉÒÔʹÓÃÎó²îÌá½»ÌØÊâµÄupfile1¡¯²ÎÊýÇëÇ󣬣¬£¬£¬£¬£¬ÉÏ´«í§ÒâÎļþ¡£¡£¡£¡£
Óû§¿É²Î¿¼Èçϳ§ÉÌÌṩµÄÇå¾²²¹¶¡ÒÔÐÞ¸´¸ÃÎó²î£ºhttps://github.com/SukaraLin/php_code_audit_project/blob/master/dedecms/dedecms%20v5.7%20sp2%20%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md
Èý¡¢Ö÷ÒªÇå¾²ÊÂÎñ×ÛÊö
1¡¢ÃÀ¹ú¿¨Ë¹µØÇøµÄÒ½ÁÆÖÐÐÄÔ⵽δ֪ÀÕË÷Èí¼þµÄ¹¥»÷
ÃÀ¹úÃÜËÕÀïÖÝ¿¨Ë¹µØÇøµÄÒ½ÁÆÖÐÐÄ³ÆÆäÔ⵽δ֪ÀÕË÷Èí¼þµÄ¹¥»÷£¬£¬£¬£¬£¬£¬ÆäÄÚ²¿Í¨Ñ¶ÏµÍ³ºÍµç×Ó¿µ½¡µµ°¸ÏµÍ³£¨EHR£©ÊÜÓ°Ïì¡£¡£¡£¡£¸ÃÒ½ÁÆÖÐÐijÆÃ»ÓÐÖ¤¾ÝÅú×¢»¼ÕßµÄÊý¾Ý±»»á¼û¡£¡£¡£¡£ÏÖÔÚ»¹²»ÇåÎúÆäÅÌËã»ú/ЧÀÍÆ÷ÔõÑù±»Ñ¬È¾£¬£¬£¬£¬£¬£¬µ«Ïà¹ØÖ´·¨²¿·ÖÒѾ½éÈë¾ÙÐÐÊӲ졣¡£¡£¡£
ÔÎÄÁ´½Ó£ºhttps://www.bleepingcomputer.com/news/security/cass-regional-medical-center-hit-with-unidentified-ransomware/
2¡¢VSDC¹ÙÍø1¸öÔÂÄÚÈý´ÎÔâºÚ¿ÍÈëÇÖ£¬£¬£¬£¬£¬£¬ÆäÈí¼þÏÂÔØÁ´½Ó±»Ð®ÖÆ
VSDCÊÇÒ»¼ÒÌṩÃâ·ÑÊÓÆµ±à¼Èí¼þµÄ¹«Ë¾£¬£¬£¬£¬£¬£¬Æä¹ÙÍøÔÚ1¸öÔÂÄÚÈý´ÎÔâµ½ºÚ¿ÍÈëÇÖ£¨6ÔÂ18ÈÕ¡¢7ÔÂ2ÈÕºÍ7ÔÂ6ÈÕ£©£¬£¬£¬£¬£¬£¬¹¥»÷Õß½«ÆäVSDCÈí¼þµÄÏÂÔØÁ´½ÓÌæ»»Îª¶ñÒâÁ´½Ó£¬£¬£¬£¬£¬£¬»®·Ö½«Óû§Öض¨ÏòÖÁÈý¸ö¶ñÒâÈí¼þ£¨Ò»¸öÓÃÓÚÇÔÈ¡Óû§ÐÅÏ¢µÄ¶ñÒâÈí¼þ£¬£¬£¬£¬£¬£¬Ò»¸ö¼üÅ̼ͼÆ÷ºÍÒ»¸öÔ¶¿ØÄ¾ÂíRAT£©¡£¡£¡£¡£VSDCÈ·ÈÏÁËÕâЩÊÂÎñ£¬£¬£¬£¬£¬£¬²¢³ÆÆäÒѾÐÞ¸´ÁËÍøÕ¾¡£¡£¡£¡£
ÔÎÄÁ´½Ó£ºhttps://www.bleepingcomputer.com/news/security/popular-software-site-hacked-to-redirect-users-to-keylogger-infostealer-more/
3¡¢Chrome²å¼þHola VPNÔ⺧£¬£¬£¬£¬£¬£¬Ô²å¼þ±»Ö²Èë¶ñÒâ´úÂë
Chrome²å¼þHola VPNµÄ¿ª·¢ÕßÕË»§ÔâºÚ¿ÍÈëÇÖ£¬£¬£¬£¬£¬£¬Æä²å¼þ±»Ö²Èë¶ñÒâ´úÂ룬£¬£¬£¬£¬£¬ÓÃÓÚ½«MyEtherWallet.comÍøÕ¾µÄÓû§Öض¨ÏòÖÁ´¹ÂÚÍøÕ¾¡£¡£¡£¡£´Ë´Î¹¥»÷±¬·¢ÔÚ7ÔÂ9ÈÕ£¬£¬£¬£¬£¬£¬¹²Ò»Á¬ÁË5¸öСʱ£¬£¬£¬£¬£¬£¬ÏÖÔڸòå¼þÒѻָ´ÖÁÇå½àµÄ°æ±¾¡£¡£¡£¡£Hola VPNÍŶÓûÓÐ͸¶¹¥»÷ÕßÔõÑù½øÈëÆäChrome¿ª·¢ÕßÕË»§¡£¡£¡£¡£MEWÍŶÓÕýÔÚ´ß´ÙʹÓô˲å¼þµÄÓû§½«Æä¼ÓÃÜÇ®±Ò×ªÒÆÖÁеÄÕË»§£¬£¬£¬£¬£¬£¬ÒÔÈ·±£Çå¾²¡£¡£¡£¡£
ÔÎÄÁ´½Ó£ºhttps://www.bleepingcomputer.com/news/security/hacker-breaches-hola-vpn-chrome-extension-to-go-after-cryptocurrency-wallet-site/
4¡¢TimehopÔâºÚ¿ÍÈëÇÖ£¬£¬£¬£¬£¬£¬Áè¼Ý2100ÍòÓû§µÄÊý¾Ýй¶
Gentoo Linux¿ª·¢ÍŶÓÐû²¼¹ØÓÚGitHubÕË»§ÔâºÚ¿ÍÈëÇÖÊÂÎñµÄÊӲ챨¸æ¡£¡£¡£¡£¸ÃÍŶӳƹ¥»÷Õßͨ¹ýÃÜÂëÍÆ²â»ñµÃÆäGitHubÕË»§µÄÃÜÂë¼°ÖÎÀíȨÏÞ£¬£¬£¬£¬£¬£¬ÊӲ췢Ã÷µÄÎÊÌ⻹°üÀ¨Î´½ÓÄÉË«ÒòËØÈÏÖ¤¡¢Î´ÉúÑÄGitHub OrganizationÏêϸÐÅÏ¢µÄ±¸·ÝÒÔ¼°systemd repoÖ±½Ó´æ´¢ÔÚGitHubÉÏ¡£¡£¡£¡£ÐÒÔ˵ÄÊÇ£¬£¬£¬£¬£¬£¬GentooºÍGithub¶Ô¸ÃÊÂÎñµÄÏìÓ¦½Ïʵʱ£¬£¬£¬£¬£¬£¬Ê¹µÃ¹¥»÷Ö»Ò»Á¬ÁËÔ¼70·ÖÖÓ¡£¡£¡£¡£
ÔÎÄÁ´½Ó£ºhttps://thehackernews.com/2018/07/timehop-data-breach.html
5¡¢Domain FactoryÈ·ÈÏÔÚ1Ô·ÝÔâºÚ¿ÍÈëÇÖ£¬£¬£¬£¬£¬£¬²¿·ÖÓû§µÄÊý¾Ýй¶
µÂ¹úÍйÜЧÀÍÌṩÉÌDomainFactoryÈ·ÈÏÔÚ1Ô·ݱ¬·¢Êý¾Ýй¶ÊÂÎñ£¬£¬£¬£¬£¬£¬²¿·ÖÓû§µÄСÎÒ˽¼ÒÊý¾Ýй¶£¬£¬£¬£¬£¬£¬µ«¸Ã¹«Ë¾Î´Åû¶ÏêϸµÄÊý×Ö¡£¡£¡£¡£Ð¹Â¶µÄÊý¾Ý°üÀ¨Óû§µÄÐÕÃû¡¢¹«Ë¾Ãû¡¢ÕË»§ID¡¢µØµã¡¢µç×ÓÓʼþµØµã¡¢µç»°ºÅÂë¡¢³öÉúÈÕÆÚ¡¢ÒøÐп¨Õ˺ŵÈÐÅÏ¢£¬£¬£¬£¬£¬£¬ÍøÂç·¸·¨·Ö×Ó¿ÉʹÓÃÕâЩÊý¾Ý¾ÙÐÐÓÐÕë¶ÔÐÔµÄÉç»á¹¤³Ì¹¥»÷¡£¡£¡£¡£DomainFactory½¨ÒéËùÓÐÓû§ÐÞ¸ÄÆäÃÜÂë¡£¡£¡£¡£
ÔÎÄÁ´½Ó£ºhttps://thehackernews.com/2018/07/web-hosting-server-hack.html