事件描述

该漏洞为Windows系统TCP/IP协议栈处理ICMPv6路由广播包时存在的远程代码执行漏洞，通过发送恶意构造的ICMPv6路由广播包，成功利用此漏洞可导致远程代码执行或拒绝服务。

漏洞编号

CVE-2020-16898

影响版本

Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1709 for ARM64-based Systems Windows 10 Version 1709 for x64-based Systems Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 2004 for 32-bit Systems

Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for x64-based Systems Windows Server 2019

Windows Server 2019 (Server Core installation)

Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server, version 2004 (Server Core installation)

安全建议

针 对 该 漏 洞 ， 微 软 已 发 布 相 关 补 丁 更 新 ， 见 如 下 链 接 :https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16898

对于暂时无法进行更新的用户，可以通过以下命令临时禁用系统中的ICMPv6RDNSS，以防止攻击者使用此漏洞，需要注意的是该方法仅适用于Windows 1709及更新的系统，该方法无需重启系统

netsh int ipv6 set int *INTERFACENUMBER* rabaseddnsconfig=disable可通过以下命令撤销之前的禁用命令

netsh int ipv6 set int *INTERFACENUMBER* rabaseddnsconfig=enable

信息化办公室

2020年10月16日