Patch Tuesday leaves Duqu 0-day for another day
No permanent fix for TrueType strike gripe
November marked a light Patch Tuesday with just four bulletins, only one of which tackles a critical flaw.
All four advisories relate to problems in Windows. None is related to the zero-day vulnerability related to Duqu, the highly sophisticated worm reckoned to be related to the infamous Stuxnet pathogen.
The flaw exploited by Duqu involves flaws in the rendering of embedded TrueType fonts, something that might be exploited through maliciously formatted Word documents. Microsoft acknowledged the flaw last Thursday, releasing a workaround that disables the rendering of embedded TrueType fonts as a temporary fix, pending the development of a proper patch to plug the security hole.
A handy graphical overview of problems Microsoft is able to fix this month can be found at the SANS Institute's Internet Storm Centre (ISC) here. ISC agrees with Microsoft that a flaw in the TCP/IP stack that "allows random code execution from a stream of UDP packets sent to a closed port" (MS11-083) covers the most sever threat in November's patch batch. However it thinks a flaw in Active Directory involving potential failures in rejecting revoked digital certificates is almost as bad and also ought to be treated as critical, one notch up from Redmond's assessment of the bug as only "important".
Neither the Active Directory bug nor the TCP/IP stack flaw have been weaponised into exploits. ®