Feeds

Patch Tuesday leaves Duqu 0-day for another day

No permanent fix for TrueType strike gripe

Intelligent flash storage arrays

November marked a light Patch Tuesday with just four bulletins, only one of which tackles a critical flaw.

All four advisories relate to problems in Windows. None is related to the zero-day vulnerability related to Duqu, the highly sophisticated worm reckoned to be related to the infamous Stuxnet pathogen.

The flaw exploited by Duqu involves flaws in the rendering of embedded TrueType fonts, something that might be exploited through maliciously formatted Word documents. Microsoft acknowledged the flaw last Thursday, releasing a workaround that disables the rendering of embedded TrueType fonts as a temporary fix, pending the development of a proper patch to plug the security hole.

A handy graphical overview of problems Microsoft is able to fix this month can be found at the SANS Institute's Internet Storm Centre (ISC) here. ISC agrees with Microsoft that a flaw in the TCP/IP stack that "allows random code execution from a stream of UDP packets sent to a closed port" (MS11-083) covers the most sever threat in November's patch batch. However it thinks a flaw in Active Directory involving potential failures in rejecting revoked digital certificates is almost as bad and also ought to be treated as critical, one notch up from Redmond's assessment of the bug as only "important".

Neither the Active Directory bug nor the TCP/IP stack flaw have been weaponised into exploits. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.