Microsoft update misses Word kernel hole

By on
Microsoft update misses Word kernel hole

Duqu survives as Microsoft stomps four nasty bugs.

Microsoft is prepping four bulletins -- each to address one vulnerability -- as part of the software giant's November security update coming Tuesday.

Expected to remain outstanding this patch cycle is the zero-day, Windows kernel flaw believed to be connected to Duqu, the so-called "son of Stuxnet" trojan, according to experts.

Microsoft said it is working to address the issue, though it has not provided a timeline for a fix nor publicly confirmed the vulnerability.

One of the bulletins Microsoft plans to release is rated “critical,” Microsoft's highest bug severity rating, reserved for flaws that could allow the propagation of an internet worm without user action, according to Microsoft's advance notification, released Thursday.

Two other patches are deemed “important,” as they could lead to remote code execution and elevation of privileges, while one is rated “moderate” and could allow for denial-of-service.  

All of the patches impact Windows and will require a reboot.

As for Duqu, Microsoft will likely issue an advisory within the next day or so and provide a hotfix for the flaw, said Paul Henry, security and forensic analyst at endpoint security software firm Lumension.

“While many dispute the threat imposed by this bug, no one disputes the risk of the zero-day vulnerability in Microsoft software that it takes advantage of,” Henry said.  

Some security experts are at odds over whether Duqu should be considered as worrisome as Stuxnet.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?