Microsoft issues official PrintNightmare fix in latest Patch Tuesday blast

representational image of a cloud firewall
(Image credit: Pixabay)

Microsoft’s July Patch Tuesday release plugs over 100 vulnerabilities, with several marked as critical, including a fix for the PrintNightmare print spooler flaw that existed in virtually all versions of Windows.

This Patch Tuesday comes just days after Microsoft put out the out-of-band updates to address PrintNightmare, which surfaced not after the release of last month’s Patch Tuesday

“Systems with misconfigurations will continue to be at risk of exploitation, even after the latest patch has been applied. PrintNightmare was a highly serious issue that further underscores the importance of marrying detection and remediation,” warns Bharat Jogi, Senior Manager, Vulnerability and Threat Research, Qualys in an email to TechRadar Pro.

TechRadar needs yo...

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.

>> <a href="https://project.tolunastart.com/tqsruntime/main?surveyData=LFFFsT0HpgsyUe0tTFumBJohXK8Sedt0ARpsCF4DRGR+oCoVbvd+2+d8+UNIIx4L" data-link-merchant="project.tolunastart.com"" target="_blank">Click here to start the survey in a new window <<

Elsewhere in Patch Tuesday

With patches to address ten critical vulnerabilities, four of which are being exploited in the wild, the July Patch Tuesday that fixes a total of 117 vulnerabilities is a pretty significant one, cybersecurity experts tell TechRadar Pro.

Scrolling through the list of addressed vulnerabilities, Kevin Breen, Director of Cyber Threat Research, Immersive Labs tells us that he thinks the scripting engine memory corruption attack, tracked as CVE-2021-34448, is perhaps the most serious. 

“It [the vulnerability] is elegant in its simplicity, letting an attacker gain remote code execution just by getting the target to visit a domain. With malicious, yet professional looking, domains carrying valid TLS certificates a regular feature nowadays, seamless compromise would be a trivial matter. Victims could even be attacked by sending .js or .hta files in targeted phishing emails,” says Breen.

Chris Goettl, Ivanti’s Senior Director of Product Management, has his eyes on the fixes for Microsoft Exchange, including the two publicly disclosed vulnerabilities and CVE-2021-31206 which he tells us was disclosed as part of the Pwn2Own contest a few months back. 

“So while Exchange has had a short reprieve after some hard back-to-back months of updates, this one should be investigated and resolved as soon as practical,” suggests Goettl.

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.