Hello and welcome to the Wednesday, July 15, 2006 edition of the Sands Inite Storm Center's Stormcast. My name is Johannes Ulrich, recorded a day from Washington, D.C.

And this episode is brought you by the Sands.edu graduate certificate program in penetration testing and ethical hacking.

Well, of course, it's patch Tuesday, and this was a special patch Tuesday.

We got 622 different vulnerabilities addressed by Microsoft, and that doesn't even include the 400 plus

vulnerabilities in chromium that also affect Microsoft Edge. Now, that of course, was a little

bit pre-announced by Microsoft. Microsoft stated to expect larger patch

Tuesdays because of AI helping them find more vulnerabilities. And I believe the largest

patch Tuesday we had before this one was probably something around 200 vulnerabilities. So

we got about a factor of three.

Now, it's hard to identify vulnerabilities that really stick out in this set, but there are

two vulnerabilities that are already being exploited. One is an active directory federation

services, elevation of privileges. Essentially,

the privilege aren't as fine-crowned as they should be, and that has already been exploited.

Microsoft rates this vulnerability as important. And then we do have another Microsoft SharePoint server

vulnerability. This is also an elevation of privilege

vulnerabilities. Microsoft only considers this vulnerability moderate. In addition to these two

exploited vulnerabilities, we have a third that is disclosed but not yet exploited, and that's

a Windows BitLocker security feature bypass vulnerability.

Now, we have heard a lot from Nightmare Clips on that topic. It's possible that this is

one of the Nightmare Clips Warnabilities. Doesn't state so in the advisory. It just credits

anonymous with discovering the vulnerability.

But the real question is, no, what does this really mean to you trying to apply these patches?

...