Microsoft Updates And Notifications for July 2021

ronjor · Jul 1, 2021

June 2021 updates for Microsoft Office

Excel, 2016 Office Standard, 2016 Office Professional 2016, More...
Microsoft released the following security and nonsecurity updates for Office in June 2021. These updates are intended to help our customers keep their computers up-to-date. We recommend that you install all updates that apply to you.
Click to expand...

ronjor · Jul 6, 2021

Microsoft Releases Out-of-Band Security Updates for PrintNightmare

Original release date: July 06, 2021
Microsoft has released out-of-band security updates to address a remote code execution (RCE) vulnerability—known as PrintNightmare (CVE-2021-34527)—in the Windows Print spooler service. According to the CERT Coordination Center (CERT/CC), “The Microsoft Windows Print Spooler service fails to restrict access to functionality that allows users to add printers and related drivers, which can allow a remote authenticated attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system.”
Click to expand...

The updates are cumulative and contain all previous fixes as well as protections for CVE-2021-1675. The updates do not include Windows 10 version 1607, Windows Server 2012, or Windows Server 2016—Microsoft states updates for these versions are forthcoming. Note: According to CERT/CC, “the Microsoft update for CVE-2021-34527 only appears to address the Remote Code Execution (RCE via SMB and RPC) variants of the PrintNightmare, and not the Local Privilege Escalation (LPE) variant.” See CERT/CC Vulnerability Note VU #383432 for workarounds for the LPE variant.
Click to expand...

CISA encourages users and administrators to review the Microsoft Security Updates
as well as CERT/CC Vulnerability Note VU #383432 and apply the necessary updates or workarounds. For additional background, see CISA’s initial Current Activity on PrintNightmare.
Click to expand...

ronjor · Jul 7, 2021

UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability.
Click to expand...

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527

EASTER · Jul 7, 2021

Thanks Lone Ranger.

ronjor · Jul 7, 2021

Patch it up.

EASTER · Jul 7, 2021

ronjor said: ↑

Patch it up.
Click to expand...

Absolutely

ronjor · Jul 13, 2021

July 2021 Security Updates

Security Update Guide

guest · Jul 13, 2021

Microsoft July 2021 Patch Tuesday fixes 9 zero-days, 117 flaws
July 13, 2021
https://www.bleepingcomputer.com/ne...21-patch-tuesday-fixes-9-zero-days-117-flaws/

Today is Microsoft's July 2021 Patch Tuesday, and with it comes fixes for nine zero-day vulnerabilities and a total of 117 flaws, so Windows admins will be pulling their hair out as they scramble to get devices patched and secured.

Microsoft has fixed 117 vulnerabilities with today's update, with 13 classified as Critical, 1 Moderate, and 103 as Important.
Of the 117 vulnerabilities, 44 are remote code execution, 32 are for elevation of privilege, 14 are information disclosure, 12 are Denial of Service, 8 are security feature bypass, and seven are spoofing vulnerabilities.
Click to expand...

anon · Jul 13, 2021

Microsoft Windows Security Updates July 2021 overview
https://www.ghacks.net/2021/07/13/microsoft-windows-security-updates-july-2021-overview/

Executive Summary

Microsoft released security updates for all supported versions of its Windows operating system.

Security updates are also available for Microsoft Office, Power BI and Visual Studio Code.

The following products have known issues: Windows 7 SP1, Windows 8.1, Windows 10 version 1809, 2004, 20H2, 21H1, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2019, ,and Windows Server 2004 and 20H2, Microsoft Exchange Server 2013, 2016 and 2019

Click to expand...

guest · Jul 13, 2021

Microsoft fixes Windows Hello authentication bypass vulnerability
July 13, 2021
https://www.bleepingcomputer.com/ne...ws-hello-authentication-bypass-vulnerability/

Microsoft has addressed a security feature bypass vulnerability in the Windows Hello authentication biometrics-based tech, letting threat actors spoof a target's identity and trick the face recognition mechanism into giving them access to the system.

According to Microsft, the number of Windows 10 customers using Windows Hello to sign in to their devices instead of a password grew from 69.4% to 84.7% during 2019.
Tsarfati reported the Windows Hello vulnerability tracked as CVE-2021-34466 and rated as Important severity to Microsoft in March.
Click to expand...

"The vulnerability allows an attacker with physical access to the device to manipulate the authentication process by capturing or recreating a photo of the target’s face and subsequently plugging in a custom-made USB device to inject the spoofed images to the authenticating host," security researcher Omer Tsarfati explained.
"We have no evidence that this attack has been used in the wild, but it could be used by a motivated attacker to target a researcher, scientist, journalist, activist or privileged user with sensitive IP on their device, for example."
Microsoft has released Windows 10 security updates to address the CVE-2021-34466 Windows Hello Security Feature Bypass Vulnerability as part of the July 2021 Patch Tuesday.
According to Redmond, Windows Hello customers with biometric sensor hardware and drivers with support for Enhanced Sign-in Security are not exposed to attacks abusing this security flaw.

"Customers with Windows Hello Enhanced Sign-in Security are protected against such attacks which tamper with the biometrics pipeline," Microsoft said in a statement.
Click to expand...

Further technical information on how the researchers bypassed Windows Hello's authentication mechanism can be found in CyberArk Labs' report.
Click to expand...

Krusty · Jul 13, 2021

mood said: ↑

Microsoft July 2021 Patch Tuesday fixes 9 zero-days, 117 flaws
July 13, 2021
https://www.bleepingcomputer.com/ne...21-patch-tuesday-fixes-9-zero-days-117-flaws/
Click to expand...

There was one publicly disclosed and actively exploited vulnerability known as PrintNightmare.

CVE-2021-34527 - Windows Print Spooler Remote Code Execution Vulnerability

Click to expand...

So does that mean we can re-enable Print Spooler service again?

anon · Jul 30, 2021

July 29, 2021—KB5004296 (OS Builds 19041.1151, 19042.1151, and 19043.1151) Preview
Windows 10, version 2004, all editions, Windows Server version 2004, Windows 10, version 20H2, all editions, Windows Server, version 20H2, all editions, Windows 10, version 21H1, all editions
https://support.microsoft.com/en-us...-preview-6aba536a-6ed2-41cb-bc3d-3980e8693cc4

Edit:
Windows 10 gaming issues fixed in KB5004296 — How to download
https://www.bleepingcomputer.com/ne...ng-issues-fixed-in-kb5004296-how-to-download/

Krusty · Jul 30, 2021

I guess Microsoft consider the PrintNightmare bug/s is/are resolved, no longer needing further fixing.

Log in or Sign up

Microsoft Updates And Notifications for July 2021

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

EASTER Registered Member

ronjor Global Moderator

EASTER Registered Member

ronjor Global Moderator

guest Guest

anon Registered Member

guest Guest

Krusty Registered Member

anon Registered Member

Krusty Registered Member

Log in or Sign up

Microsoft Updates And Notifications for July 2021

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

EASTER Registered Member

ronjor Global Moderator

EASTER Registered Member

ronjor Global Moderator

guest Guest

anon Registered Member

guest Guest

Krusty Registered Member

anon Registered Member

Krusty Registered Member

Useful Searches