Microsoft July 2021 Patch Tuesday fixes 9 zero-days, 117 flaws

Today is Microsoft's July 2021 Patch Tuesday, and with it comes fixes for nine zero-day vulnerabilities and a total of 117 flaws, so Windows admins will be pulling their hair out as they scramble to get devices patched and secured.

Microsoft has fixed 117 vulnerabilities with today's update, with 13 classified as Critical, 1 Moderate, and 103 as Important.

Of the 117 vulnerabilities, 44 are remote code execution, 32 are for elevation of privilege, 14 are information disclosure, 12 are Denial of Service, 8 are security feature bypass, and seven are spoofing vulnerabilities.

For information about the non-security Windows updates, you can read about today's Windows 10 KB5004237 & KB5004245 cumulative updates.

Nine zero-days fixed, with four actively exploited

July's Patch Tuesday includes nine zero-day vulnerabilities, with four actively exploited in the wild.

Microsoft classifies a zero-day vulnerability as publicly disclosed or actively exploited with no official security updates or released.

The five publicly disclosed, but not exploited, zero-day vulnerabilities are:

• CVE-2021-34492 - Windows Certificate Spoofing Vulnerability
• CVE-2021-34523 - Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-33779 - Windows ADFS Security Feature Bypass Vulnerability
• CVE-2021-33781 - Active Directory Security Feature Bypass Vulnerability

There was one publicly disclosed and actively exploited vulnerability known as PrintNightmare.

• CVE-2021-34527 - Windows Print Spooler Remote Code Execution Vulnerability

Finally, there are three actively exploited Windows vulnerabilities that were not publicly disclosed.

• CVE-2021-33771 - Windows Kernel Elevation of Privilege Vulnerability
• CVE-2021-34448 - Scripting Engine Memory Corruption Vulnerability
• CVE-2021-31979 - Windows Kernel Elevation of Privilege Vulnerability

The print nightmare

Last month, a proof-of-concept exploit was released by accident for the zero-day PrintNightmare vulnerability that allows remote code execution and local privilege escalation.

Due to the severity of the attacks, Microsoft released an out-of-band KB5004945 security update that was supposed to fix the PrintNightmare vulnerability tracked as CVE-2021-34527.

Microsoft's OOB patch only resolves the vulnerability if the Point and Print policy is disabled. The patch can be bypassed for those devices that still have this registry setting enabled to achieve remote code execution and local privilege escalation.

However, Microsoft states that the patches are working as intended and that Windows admins should install the patches immediately as the vulnerabilities are being actively exploited.

"Our investigation has shown that the OOB security update is working as designed and is effective against the known printer spooling exploits and other public reports collectively being referred to as PrintNightmare," the Microsoft Security Response Center explains.

"All reports we have investigated have relied on the changing of default registry setting related to Point and Print to an insecure configuration."

Security research and Mimikatz creator feels that the patch still needs improvement to protect against the bypasses he and others have found

Clarified Guidance for CVE-2021-34527 #printnightmare

So I presume all is OK, and:
- you will not change UNC path detection
- RestrictDriverInstallationToAdministrators & driver no explaination?

It's not, and you know it

> https://t.co/ONmlFjuhn0 pic.twitter.com/aqMDS8gdJa

—  Benjamin Delpy (@gentilkiwi) July 9, 2021

Recent updates from other companies

Other vendors who released updates in July include:

• Adobe released security updates for five products.
• Android's July security updates were released last week.
• Cisco released security updates for numerous products this month.
• SAP released its July 2021 security updates.
• VMware released security updates for ESXi and ThinApp.

The July 2021 Patch Tuesday Security Updates

Below is the full list of resolved vulnerabilities and released advisories in the July 2021 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects, you can view the full report here.