Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Microsoft/Windows
Fiercely productive scanners
Average Rating:
Rate this article:  
No Zero-Day Office Flaw Fix on Patch Tuesday
No Zero-Day Office Flaw Fix on Patch Tuesday

By Jennifer LeClaire
November 8, 2013 10:27AM

    Bookmark and Share
Microsoft's November Patch Tuesday Advance Bulletin is out and everyone is breathing a sigh of relief and frustration. Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday for Microsoft. And frustration because Microsoft hasn't provided a fix for the zero-day flaw, said security expert Ross Barrett.
 



Microsoft plans to deliver eight security bulletins on Patch Tuesday next week. Three of them are rated critical; five are important. The three critical updates address vulnerabilities in Internet Explorer and Microsoft Windows. The important updates address issues in Windows and Office.

What this release won’t include is an update for the zero-day vulnerability that impacts Office, Windows and Lync announced earlier this week. Dustin Childs, group manager for the Microsoft Security Response Center, said the company is working to develop a security update and will release it when it’s ready. That opens the door to the possibility of an out-of-band patch for the flaw, which exists in the way affected components handle TIFF images.

“In the meantime, the advisory includes a Fix it that prevents the attacks from succeeding and we recommend customers apply it to help protect their systems,” Childs said. “We also want to provide clarification on the products that the advisory notes are affected. We’ve seen some confusion due to the shared nature of the GDI+ component, which is where the issue resides. There are three ways you can have the GDI+ component installed on your system: Office, Windows, and Lync.”

Relief and Frustration

With regard to the TIFF flaw, Childs said Office 2003 and Office 2007 are affected regardless of the installed operating system. Microsoft is currently only aware of targeted attacks against Office 2007 users. Office 2010 is affected only if installed on Windows XP or Windows Server 2003. Office 2010 is not affected when installed on Windows Vista or newer systems. Office 2013 is not affected, regardless of the OS platform.

On the Windows side, supported versions of Vista and Windows Server 2008 ship with the affected component but are not known to be under active attack. Other versions of Windows are not directly impacted. Customers who use these systems are only impacted if they have an affected version of Office or Lync, Childs said. All supported versions of the Lync client are affected but are not known to be under active attack.

“The November Patch Tuesday Advance Bulletin is out and I think everyone is breathing a sigh of both relief and frustration,” Ross Barrett, senior manager of security engineering at security firm Rapid7, told us. “Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday, with fixes for most Windows versions, the ever-present IE roll-up patch, and some Office components, but nothing esoteric or difficult to patch. No SharePoint plugins, no complicated .NET patching, no esoteric office extensions.” And frustration, he added, because there’s no fix for the zero-day flaw.

Another Busy Month

Overall, Paul Henry, a security and forensic analyst at security firm Lumension, told us it’s another busy month for IT. As he sees it, the first patching priority should be bulletin 1, which is a critical remote code execution for Internet Explorer given its widespread use.

The second priority would be bulletin 2, which could allow a remote code execution in Windows. Third on your list of priorities will likely be the final critical bulletin, number 3, he said, which will be another remote code execution in Windows.

“The remaining bulletins shake out with an important rating,” he said. “Bulletin 4 will be a remote code execution for Office. Bulletin 5 will be an elevation of privilege issue in Windows. Bulletin 6 an information disclosure issue in Windows, bulletin 7 an information disclosure issue in Office, and bulletin 8 will be a denial of service in Windows.”
 

Tell Us What You Think
Comment:

Name:



Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.


 Microsoft/Windows
1.   Review: Windows Embraces the Past
2.   Patch Tuesday Offers Critical Fixes
3.   China Approves Microsoft-Nokia Deal
4.   Microsoft Pulls Plug on Windows XP
5.   Against a Wall, Some Buy XP Support


advertisement
Last Fixes Tuesday for XP, Office 2003
Microsoft closing out support for two.
Average Rating:
Review: Windows Embraces the Past
With small but significant tweaks.
Average Rating:
Windows 8 Updates Expected Soon
Using OS feedback, security concerns.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Michaels Says Nearly 3M Credit, Debit Cards Breached
Arts and crafts retail giant Michaels Stores has confirmed that a data breach at its POS terminals from May 2013 to Jan. 2014 may have exposed nearly 3 million customer credit and debit cards.
 
Heartbleed Could Cost Millions, Could Have Been Prevented
Early estimates of Heartbleed’s cost to enterprises are running in the millions. The reason: revoking all the SSL certificates the bug leaked will come at a very hefty price.
 
Google's Street View Software Unravels CAPTCHAs
The latest software Google uses for its Street View cars to read street numbers in images for Google Maps works so well that it also solves CAPTCHAs, those puzzles designed to defeat bots.
 

Enterprise Hardware Spotlight
Vaio Fit 11A Battery Danger Forces Recall by Sony
Using a Sony Vaio Fit 11A laptop? It's time to send it back to Sony. In fact, Sony is encouraging people to stop using the laptop after several reports of its Panasonic battery overheating.
 
Continued Drop in Global PC Shipments Slows
Worldwide shipments of PCs fell during the first three months of the year, but the global slump in PC demand may be easing, with a considerable slowdown from last year's drops.
 
Google Glass Finds a Home in Medical Education, Practice
Google Glass may find its first markets in verticals in which hands-free access to data is a boon. Medicine is among the most prominent of those, as seen in a number of Glass experiments under way.
 

Mobile Technology Spotlight
Google Releases Chrome Remote Desktop App for Android
You're out on a sales call, and use your Android mobile device to grab a file you have back at the office on your desktop. That's a bit easier now with Google's Chrome Remote Desktop app for Android.
 
Amazon 3D Smartphone Pics Leaked
E-commerce giant Amazon is reportedly set to launch a smartphone after years of development. Photos of the phone, which may feature a unique 3D interface, were leaked by tech pub BGR.
 
Zebra Tech Buys Motorola Enterprise for $3.45B
Weeks after Lenovo bought Motorola Mobility’s assets from Google for $2.91 billion, Zebra Technologies is throwing down $3.45 billion for Motorola’s Enterprise business in an all-cash deal.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | Small Business | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.