Hello and welcome to the Wednesday, March 11th, 2006 edition of the Sands Inlet Storm Centers, Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida. And this episode is brought you by the Sands.edu credit certificate program in cloud security.

Well, and today, of course, Microsoft's patch Tuesday leads the news. Microsoft did release updates,

fixing 93 vulnerabilities, nine vulnerabilities in chromium that affect Microsoft Edge.

Now, among the vulnerabilities, we had eight critical vulnerabilities, and two that were disclosed prior to the day, but this time we had no vulnerability that was actually already exploited.

Now, when it comes to disclosed vulnerabilities, the first one is a denial of service

vulnerability in dot net. Microsoft considers exploitation unlikely and denial of service

vulnerabilities. While this one doesn't require authentication, it could be exploited across

the network. It's still not usually sort of at the top of the priority.

The second one is probably even a little bit more interesting.

It's a privilege escalation in SQL server.

Now you need to be authenticated in this case to then escalate privilege to sysadmin,

but the scenario that I envision here is where, for example, you have a web

application or something like this that has access to a SQL server using a lower

privileged account. Maybe there's a chance here to exploit that, but that's not really clear

from the advisory. The advisor is usually fairly sparse.

Among the critical vulnerabilities, there are a couple of them that are included in the list here,

but they're actually in Microsoft's cloud products, and that's, you know, they have started

doing that in the last few months, sort of for transparency where they tell you what they're patched in the cloud.

So those are nothing where you have to do anything.

Like there's a Microsoft Payment Orchestrator.

There's also Microsoft ACI confidential containers.

These four vulnerabilities between those two products are all cloud-based, so nothing

...