Традиционный аудио/видео эпизод по итогам июльского Microsoft Patch Tues­day. В этом месяце получилось и уязвимости разобрать, и доработать Vul­ris­tics. 😇 В августе буду в основном всякими образовательными инициативами заниматься. 🤫 Следите за обновлениями. 🙂

——

Hel­lo every­one! This episode will be about Microsoft Patch Tues­day for July 2023, includ­ing vul­ner­a­bil­i­ties that were added between June and July Patch Tues­days.

Vul­ris­tics improve­ments
00:11 Works faster
01:31 Microsoft ADVs
02:45 Com­ments Table

TOP
04:09 Remote Code Exe­cu­tion – Microsoft Office (CVE-2023–36884)
05:06 Secu­ri­ty Fea­ture Bypass – Win­dows SmartScreen (CVE-2023–32049)
05:48 Secu­ri­ty Fea­ture Bypass – Microsoft Out­look (CVE-2023–35311)
06:37 Ele­va­tion of Priv­i­lege – Win­dows Error Report­ing Ser­vice (CVE-2023–36874)
07:16 Ele­va­tion of Priv­i­lege – Win­dows MSHTML Plat­form (CVE-2023–32046)

Oth­er RCEs
08:10 Remote Code Exe­cu­tion – Win­dows Active Direc­to­ry Cer­tifi­cate Ser­vices (AD CS) (CVE-2023–35350)
09:01 Remote Code Exe­cu­tion – Microsoft Mes­sage Queu­ing (CVE-2023–32057, CVE-2023–35309)
09:44 Remote Code Exe­cu­tion – Win­dows Rout­ing and Remote Access Ser­vice (RRAS) (CVE-2023–35365, CVE-2023–35366, CVE-2023–35367)
10:24 Remote Code Exe­cu­tion – Win­dows Layer‑2 Bridge Net­work Dri­ver (CVE-2023–35315)
10:57 Remote Code Exe­cu­tion – Microsoft Share­Point (CVE-2023–33134, CVE-2023–33157, CVE-2023–33159, CVE-2023–33160)
11:42 Remote Code Exe­cu­tion – Win­dows Prag­mat­ic Gen­er­al Mul­ti­cast (PGM) (CVE-2023–35297)

🎞 Video
🎞 Video2 (for Rus­sia)
📘 Blog­post
🗒 Vul­ris­tics report