Hello, welcome to the Wednesday, September 14th, 2016 edition of the Sansonet Storms, StormCast. My name is Johannes Ulrich, and today I'm recording from Las Vegas, Nevada.

Today we kind of got a patch super Tuesday with patches not only from Microsoft and Adobe, but also updates from Apple. So let's start with the probably most

important set here and that's Microsoft. Microsoft released a total of 14 bulletins, seven of

which are rated critical. Now one of these bulletins is for Adobe's Flash Player, which is also

included in Microsoft products like its browsers. The first two bulletins, MS-16-104 and

105 are as usual for Microsoft's Internet Explorer and Edge the monthly cumulative security update.

These fix a number of different vulnerabilities, most importantly one that already has been

exploited in the wild.

Luckily, it's only an information disclosure of vulnerability that could help NetHacker to exploit other remote code execution vulnerabilities in the browser.

Essentially, these information disclosure vulnerabilities allow NetHacker to learn more about Innet Explorer's or Edge's memory layout,

which then makes a successful exploit for another vulnerability more likely.

MS 106 is a security update for Microsoft's graphics component.

Something we have seen before these graphics, kernel drivers, can be used to execute arbitrary code so certainly you

should patch these rather quickly similar ms 16107 the usual security update for Microsoft office

fixes yet another set of vulnerabilities that can be triggered if the user

does open crafted Office documents. M.S16108 gets a little bit more interesting again.

This is an update for Microsoft Exchange Server. It does actually update the Oracle outside in libraries.

We have seen vulnerabilities in these libraries before. They are typically used to convert documents

and many different piece of software are using these libraries. It's not just Exchange Server.

Oracle did fix a number of vulnerabilities in these libraries. It's not just Exchange Server. Oracle did fix a number of vulnerabilities in these

libraries back in July in Oracle's last quarterly critical patch update. This update for

the Exchange Server does patch Microsoft's use of these libraries in Exchange Server.

...