Hello and welcome to the Wednesday, November 9th, 2020 edition of the Sands and its Storm Center's Stormcast. My name is Johannes Ulrich. And I'm recording from Jacksonville, Florida.

Well, today, of course, Microsoft's Patch Tuesday, and that's, of course, what we'll spend a good part of this podcast with. We got

patches for a total of 68 vulnerabilities. 10 of these vulnerabilities are rated as a critical.

One has previously been disclosed and four are already being exploited, which may sort of

be a record, not 100% sure, but let's talk a little bit about some of these vulnerabilities,

and there are some fairly interesting ones here. First of all, Mark of the Web, I mentioned

this a few times in this podcast.

Tends to be difficult to really close all the gaps here. The idea is that files are marked

as they're being downloaded from online resources. One issue apparently here was that

if a file was right protected, then the

mark of the web could not be applied to it. We also had, of course, in the past problems with

archives and such. Not 100% sure how much of this will be addressed here, but one of the vulnerabilities

already disclosed and already being exploited, the other one neither.

But the second vulnerability here is also more likely to be exploited according to Microsoft.

Now, these are only important, of course, because there's no sort of immediate code execution, anything like this, due to this vulnerability.

We also got then another Windows print spooler elevation of privilege vulnerability already being exploited.

Looks like a variation of that print nightmare that we had a while ago. Seems like

almost every month we get another little patch about this here from Microsoft. And then a Windows

scripting languages, remote code execution vulnerability also already exploited and with a CVS score of 8.8.

And the last one that's already being exploited is Windows CNG key isolation service

vulnerability and that is a Burbage escalation vulnerability as an attacker may obtain

keys from other users. That's already, again, being

...