Microsoft’s November Patch Tuesday Advance Bulletin is out and everyone is breathing a sigh of relief and frustration. Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday for Microsoft. And frustration because Microsoft hasn’t provided a fix for the zero-day flaw, said security expert Ross Barrett.
You have the experience and skills, let ISACA® certification demonstrate your value. Our certifications announce that you have the expertise and insight to speak with authority. ISACA certification is more than a credential; it’s a platform that can elevate your career. Explore our certifications.
 Microsoft plans to deliver eight security bulletins on Patch Tuesday next week. Three of them are rated critical; five are important. The three critical updates address vulnerabilities in Internet Explorer and Microsoft Windows. The important updates address issues in Windows and Office.What this release won’t include is an update for the zero-day vulnerability that impacts Office, Windows and Lync announced earlier this week. Dustin Childs, group manager for the Microsoft Security Response Center, said the company is working to develop a security update and will release it when it’s ready. That opens the door to the possibility of an out-of-band patch for the flaw, which exists in the way affected components handle TIFF images.“In the meantime, the advisory includes a Fix it that prevents the attacks from succeeding and we recommend customers apply it to help protect their systems,” Childs said. “We also want to provide clarification on the products that the advisory notes are affected. We’ve seen some confusion due to the shared nature of the GDI+ component, which is where the issue resides. There are three ways you can have the GDI+ component installed on your system: Office, Windows, and Lync.
”Relief and Frustration With regard to the TIFF flaw, Childs said Office 2003 and Office 2007 are affected regardless of the installed operating system. Microsoft is currently only aware of targeted attacks against Office 2007 users. Office 2010 is affected only if installed on Windows XP or Windows Server 2003. Office 2010 is not affected when installed on Windows Vista or newer systems. Office 2013 is not affected, regardless of the OS platform.On the Windows side, supported versions of Vista and Windows Server 2008 ship with the affected component but are not known to be under active attack. Other versions of Windows are not directly impacted. Customers who use these systems are only impacted if they have an affected version of Office or Lync, Childs said. All supported versions of the Lync client are affected but are not known to be under active attack.“The November Patch Tuesday Advance Bulletin is out and I think everyone is breathing a sigh of both relief and frustration,” Ross Barrett, senior manager of security engineering at security firm Rapid7, told us. “Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday, with fixes for most Windows versions, the ever-present IE roll-up patch, and some Office components, but nothing esoteric or difficult to patch. No SharePoint plugins, no complicated .NET patching, no esoteric office extensions.” And frustration, he added, because there’s no fix for the zero-day flaw. |
