Microsoft update misses Word kernel hole

Powered by SC Magazine
 

Duqu survives as Microsoft stomps four nasty bugs.

Microsoft is prepping four bulletins -- each to address one vulnerability -- as part of the software giant's November security update coming Tuesday.

Expected to remain outstanding this patch cycle is the zero-day, Windows kernel flaw believed to be connected to Duqu, the so-called "son of Stuxnet" trojan, according to experts.

Microsoft said it is working to address the issue, though it has not provided a timeline for a fix nor publicly confirmed the vulnerability.

One of the bulletins Microsoft plans to release is rated “critical,” Microsoft's highest bug severity rating, reserved for flaws that could allow the propagation of an internet worm without user action, according to Microsoft's advance notification, released Thursday.

Two other patches are deemed “important,” as they could lead to remote code execution and elevation of privileges, while one is rated “moderate” and could allow for denial-of-service.  

All of the patches impact Windows and will require a reboot.

As for Duqu, Microsoft will likely issue an advisory within the next day or so and provide a hotfix for the flaw, said Paul Henry, security and forensic analyst at endpoint security software firm Lumension.

“While many dispute the threat imposed by this bug, no one disputes the risk of the zero-day vulnerability in Microsoft software that it takes advantage of,” Henry said.  

Some security experts are at odds over whether Duqu should be considered as worrisome as Stuxnet.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Microsoft update misses Word kernel hole
 
 
 
Top Stories
NSW to build its own myGov
Service NSW digital profiles available by September.
 
Android bug leaves a billion phones open to attack
Hackers only need phone number to target devices.
 
Australia's leaders agree to end GST-free online goods
Gerry Harvey may finally get his way.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Microsoft reveals Microsoft Send, a new enterprise chat app to rival Slack
Jul 27, 2015
Microsoft Send is MSN Messenger for grownups, and you could be using it at work very soon
Developers offered $500,000 grants to find HoloLens uses
Jul 8, 2015
Can augmented-reality end up in business?
Microsoft Tossup: The planning app for unorganised groups of friends
Jul 8, 2015
App allows friends to research venues, vote on plans and chat. And depending on how you run your ...
Windows 10 drops 29 July... but only for some
Jul 6, 2015
If you've reserved your copy of Windows 10 and are keenly awaiting its 29 July release, don't ...
Xerocon is heading to Melbourne!
Jul 1, 2015
We're not saying Xero is our FAVOURITE or anything, but Xero's 2015 Xerocon conference is being ...
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  13%
 
No
  51%
 
Only in special circumstances
  17%
 
Yes, but with more transparency
  19%
TOTAL VOTES: 707

Vote