Microsoft’s November Patch Tuesday Advance Bulletin is out and everyone is breathing a sigh of relief and frustration. Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday for Microsoft. And frustration because Microsoft hasn’t provided a fix for the zero-day flaw, said security expert Ross Barrett.

You have the experience and skills, let ISACA® certification demonstrate your value. Our certifications announce that you have the expertise and insight to speak with authority. ISACA certification is more than a credential; it’s a platform that can elevate your career. Explore our certifications.
![]() ”Relief and Frustration With regard to the TIFF flaw, Childs said Office 2003 and Office 2007 are affected regardless of the installed operating system. Microsoft is currently only aware of targeted attacks against Office 2007 users. Office 2010 is affected only if installed on Windows XP or Windows Server 2003. Office 2010 is not affected when installed on Windows Vista or newer systems. Office 2013 is not affected, regardless of the OS platform.On the Windows side, supported versions of Vista and Windows Server 2008 ship with the affected component but are not known to be under active attack. Other versions of Windows are not directly impacted. Customers who use these systems are only impacted if they have an affected version of Office or Lync, Childs said. All supported versions of the Lync client are affected but are not known to be under active attack.“The November Patch Tuesday Advance Bulletin is out and I think everyone is breathing a sigh of both relief and frustration,” Ross Barrett, senior manager of security engineering at security firm Rapid7, told us. “Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday, with fixes for most Windows versions, the ever-present IE roll-up patch, and some Office components, but nothing esoteric or difficult to patch. No SharePoint plugins, no complicated .NET patching, no esoteric office extensions.” And frustration, he added, because there’s no fix for the zero-day flaw. |