Microsoft security update addresses four flaws, not Duqu

Share this article:

Microsoft is prepping four bulletins -- each to address one vulnerability -- as part of the software giant's November security update coming Tuesday.

Expected to remain outstanding this patch cycle is the zero-day, Windows kernel flaw believed to be connected to Duqu, the so-called "son of Stuxnet" trojan, according to experts. In a tweet Tuesday, Microsoft said it is working to address the issue, though it has not provided a timeline for a fix, nor has it even publicly confirmed the vulnerability.

One of the bulletins Microsoft plans to release is rated “critical,” Microsoft's highest bug severity rating, reserved for flaws that could allow the propagation of an internet worm without user action, according to Microsoft's advance notification, released Thursday. Two other patches are deemed “important,” as they could lead to remote code execution and elevation of privileges, while one is rated “moderate” and could allow for denial-of-service.  

All of the patches impact Windows and will require a reboot.

As for Duqu, Microsoft will likely issue an advisory within the next day or so and provide a hotfix for the flaw, Paul Henry, security and forensic analyst at endpoint security software firm Lumension, told SCMagazineUS.com in an email Thursday.

“While many dispute the threat imposed by this bug, no one disputes the risk of the zero-day vulnerability in Microsoft software that it takes advantage of,” Henry said.  

Some security experts are at odds over whether Duqu should be considered as worrisome as Stuxnet.

Share this article:

Sign up to our newsletters

More in News

Details emerge about PlugX/Kaba RAT in Pacific Rim

FireEye researchers took a closer look at the malware and provided details in a blog post last week.

Michaels class-action suit tossed after plaintiffs can't show damage

A judge ruled that plaintiffs couldn't show monetary damage in suit filed after a breach exposed data on 2.6 million of the retailer's customers.

New backdoor 'Baccamun' spreads through ActiveX exploit

Symantec researchers revealed that the backdoor is dropped after attackers exploit a Windows ActiveX vulnerability.