Hello, welcome to the Wednesday, July 14, 2021 edition of the Sandstone at Storm Center's Stormcast.

My name is Johannes Ulrich.

And today I'm recording from Jacksonville, Florida.

Well, it's Microsoft Patch Tuesday, and it was, well, probably a little bit more than an sort of patch Tuesday with 117 vulnerabilities.

Nine vulnerabilities were either already exploited or at least publicly disclosed.

And of course, one of these nine is the famous print nightmare, print spooler vulnerability

that was patched late last week.

Now, for everybody who expected maybe another iteration of the print spooler patch,

there was no such thing, and there is not likely going to be another patch.

Microsoft has explained that the patch that they released is complete, and of course,

you also need to heed Microsoft's

configuration advice in order to completely mitigate the vulnerability, the remote code execution,

as well as the privilege escalation part of the vulnerability. There was also an interesting

vulnerability that was patched in Windows Hello.

Windows Hello is Microsoft's biometrics way to log into Windows workstations,

and apparently it was possible to essentially capture an infrared image of an individual,

then create a USB device that would emulate a camera and

just deliver this one individual frame. Of course, part of the problem here with Windows

Hello is that it has to work with a wide range of different hardware devices, unlike, for

example, Apple's Face ID, which will only work with

very specific cameras that are integrated into Apple devices.

You also got critical patches for Exchange Server again, so that's always, of course,

...