Microsoft’s April Patch Tuesday release includes fixes for 66 bugs, 24 of which are rated critical.
4月的周二补丁日，
微软公布了66个漏洞的补丁，其中24个漏洞被评为严重（critical）漏洞。
1、SharePoint的提权升级漏洞
Notable is Microsoft’s disclosure of a publicly known SharePoint elevation of privilege bug (CVE-2018-1034), rated important, which has no fix but has not been publicly exploited.
And privilege control can also be accessed initiatively or passively.
对用户的权限控制，也采用两种不同的方式：主动访问或被动访问。
exploited [ɛksplɔɪt; ɪkˈsplɔɪt] v. 利用
eg
The essence of software vulnerability is to exploit and affect system security.
软件脆弱性的本质是利用该脆弱性可以影响系统的安全。
Microsoft SharePoint Enterprise Server 2016 is the only version impacted by the vulnerability, according to Microsoft. “An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server,” Microsoft said.
据微软所称，SharePoint Server 2016 是唯一收到这个漏洞影响的版本，并称：“只有在Microsoft SharePoint Server 没有适当的清除发送给受影响服务器的网页请求时，提权漏洞才能被利用。已验证的黑客可以通过发送一个精心制作的请求来影响SharePoint server。”
vulnerability [,vʌlnərə'bɪləti] n. 脆弱性、安全隐患，在这里译为了漏洞
sanitize ['sænɪtaɪz] v. 1. 使…无害；给…消毒；对…采取卫生措施；2.清除
eg.
to sanitize a picture magazine
净化画刊中不健康的内容
authenticated [ɔ'θɛntɪ,ket] n. 已验证,已认证
eg.
Obviously, for this model to work each user must be authenticated.
显然，要使这个模型生效，每个用户都必须经过认证。
Security experts say one of the most important patches rolled out Tuesday was actually identified in March (CVE-2018-1038). If exploited, the bug could allow an authenticated attacker to install programs, access stored data or create new accounts with full user rights on Windows 7 and Server 2008 R2 machines.
“While this vulnerability was identified between March and April Patch Tuesday’s, CVE-2018-1038 should be a top priority for anyone who has Windows 7 for x64-based Systems or Windows Server 2008 R2 for x64-based Systems, and you have installed any of the servicing updates released during or after January 2018, you need to install 4100480 immediately to be protected from this Elevation of Privilege vulnerability,” Goettl said in his commentary on Patch Tuesday.
虽然这个漏洞是在3、4月份的周二补丁日之间发现的，但对正在使用x64 Windows7 系统或 x64 系统的Windows Server 2008 R2 的用户而言，解决这个漏洞是重中之重。凡是在2018年一月期间或之后安装任何服务更新的用户，请务必立刻安装4100480，免受提权升级漏洞的影响。Goettl 在周二补丁日的注释中说道。
top priority 当务之急，最优先级
2、无线键盘 850 的一个绕过漏洞
Also of note is a patch for a Microsoft Wireless Keyboard 850 Security Feature Bypass Vulnerability (CVE-2018-8117).
另一个需要注意的是针对微软 无线键盘 850 的一个绕过漏洞，所打的补丁。
“Patches for hardware are rare, and patches for keyboards are especially rare, so it was somewhat shocking to see this bug detailed. However, the severity of this bug should not be scoffed at,” the Zero Day Initiative’s (ZDI) Dustin Childs said in an analysis of the vulnerability. “This vulnerability could affect you in two ways. First, an attacker could read your keystrokes – effectively turning your keyboard into a keystroke logger. Everything you type – passwords, account details, emails – could be viewed.”
Alternatively, an attacker could also inject keystrokes to an affected system by reusing the keyboard’s AES encryption key.
另一方面，攻击者还可以通过 重新利用键盘的AES加密秘钥像受影响的系统注入按键。
inject 注入
3、 VBScript Engine 远程代码执行漏洞
Childs also warns that a critical Windows VBScript Engine Remote Code Execution Vulnerability (CVE-2018-1004) also presents a heightened security risk. “This critical-rated bug for the VBScript engine acts somewhat like a browser bug, but it’s actually more impactful,” he said. To exploit the vulnerability an attacker hosts a malicious website and tricks a victim to browse the site.
“An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” according to Microsoft.
Microsoft also alerted users to five Graphics Remote Code Execution Vulnerabilities (CVE-2018-1010, -1012, -1013, -1015, -1016) tied to the Windows Font Library. “Each of these patches covers a vulnerability in embedded fonts that could allow code execution at the logged-on user level. Since there are many ways to view fonts – web browsing, documents, attachments – it’s a broad attack surface and attractive to attackers,” ZDI noted.
Microsoft Malware Protection Engine was fixed last week in an out-of-band security update.
Microsoft 的恶意软件防护引擎，已于上周的一次带外的安全更新中修复。
Earlier on Tuesday, Adobe fixed four critical vulnerabilities in its Flash Player and InDesign products. Patches for Adobe Flash Player for Microsoft Edge and IE 11 were part of that update. Adobe said Edge and IE users will each be automatically updated to the latest versions.
周二的早些时候，Adobe修复了Flash Player和 Indesign 产品中的四个关键漏洞。Microsoft Edge and IE 11 的补丁也是这次更新的一部分。Adobe称 Edge和IE的用户都会自动升级到最新版本。
补充：
1、周二补丁日
Patch Tuesday (also known as Update Tuesday)本文译为周二补丁日，is an unofficial term used to refer to when Microsoft regularly releases security patches for its software products. It is widely referred to in this way by the industry.Microsoft formalized Patch Tuesday in October 2003.
