ess

ETSI hosts another successful Security Week

ETSI hosts another successful Security Week

Sophia Antipolis, 21 June 2019

ETSI Security Week 2019 (17-21 June) attracted over 300 attendees to ETSI’s headquarters to listen to presentations and engage in panel discussions and networking with leading experts in cybersecurity from industry, universities, governmental bodies and national security agencies.

Read More...




ess

ETSI specifications on licensed shared spectrum successfully implemented in the Netherlands for the entertainment industry

ETSI specifications on licensed shared spectrum successfully implemented in the Netherlands for the entertainment industry

Sophia Antipolis, 8 July 2019

After a successful pilot in 2017, the Dutch administration (Radiocommunications Agency Netherlands) has decided to implement Licensed Shared Access (LSA) technology, based on ETSI specifications.

Read More...




ess

ETSI standardizes new Secure Platform to address IoT, 5G, and security sensitive sectors

ETSI standardizes new Secure Platform to address IoT, 5G, and security sensitive sectors

Sophia Antipolis, 18 November 2019

Trust and privacy together with cost and flexibility are key to security solutions for many applications in today’s digital world. To address this challenge, ETSI Technical Committee Smart Card Platform, who standardized the former generations of SIM cards, has been working on a brand-new security platform called Smart Secure Platform (SSP). The ETSI committee is pleased to unveil the first three technical specifications to launch this new security platform.

Read More...




ess

First ETSI C-V2X interoperability event: success rate of 95% achieved

First ETSI C-V2X interoperability event: success rate of 95% achieved

Sophia Antipolis, 11 December 2019

The first ETSI C-V2X PlugtestsTM, performed in partnership with 5GAA, came to a close with a success rate of 95% of the executed tests, showing an extremely positive level of multi-vendor interoperability. 320 test scenarios were executed in lab and field environments for interoperability with 70 people present onsite for testing.

Read More...




ess

ETSI Multi-access Edge Computing builds on NFV and network slicing

ETSI Multi-access Edge Computing builds on NFV and network slicing

Sophia Antipolis, 15 January 2020

The ETSI Multi-access Edge Computing Industry Specification Group is pleased to announce the release of two major reports as part of its Phase 2 work. The report ETSI GR MEC 027 studies the impact of alternative virtualization technologies. The second report, ETSI GR MEC 024, examines network slicing on edge computing systems.

Read More...




ess

ETSI Multi-access Edge Computing group reaches 100 members confirming attractiveness of the group

ETSI Multi-access Edge Computing group reaches 100 members confirming attractiveness of the group

Sophia Antipolis, 31 March 2020

Strategy Analytics believes that 59% of all IoT deployments will be processing data using edge computing of some form by 2025. Furthermore, a survey from ResearchAndMarkets predicts that mobile edge computing as a service market will reach $73M by 2024, driven by enterprise hosted deployments. No wonder that ISG MEC - one of ETSI’s most dynamic Industry Specification Groups - keeps growing and has now welcomed its 100th member with Mitsubishi Electric R&D Centre Europe.

Read More...




ess

ETSI launches new group on Non-IP Networking addressing 5G new services

ETSI launches new group on Non-IP Networking addressing 5G new services

Sophia Antipolis, 7 April 2020

ETSI is pleased to announce the creation of a new Industry Specification Group addressing Non-IP Networking (ISG NIN). The kick-off-meeting took place on 25 March and John Grant, BSI, was elected as the ISG Chair, and Kevin Smith, Vodafone, was elected as ISG Vice Chair.

With the increasing challenges placed on modern networks to support new use cases and greater connectivity, Service Providers are looking for candidate technologies that may serve their needs better than the TCP/IP-based networking used in current systems.

ISG NIN intends to develop standards that define technologies to make more efficient use of capacity, have security by design, and provide lower latency for live media.

Read More...




ess

ETSI virtual Security Week 2020: a record audience for first sessions

ETSI virtual Security Week 2020: a record audience for first sessions

Sophia Antipolis, 12 June 2020

Register for next week.

Our virtual Security Week started this Monday, 8 June and will end on 19 June with nearly 50 speakers discussing the latest updates and challenges of four different key topics around cybersecurity in 14 webinars.

Read More...




ess

Successful ETSI virtual Security Week 2020 with over 4000 viewers

Successful ETSI virtual Security Week 2020 with over 4000 viewers

Sophia Antipolis, 24 June 2020

The ETSI virtual Security Week 2020, that took place from 8 June to 23 June, successfully closed with a record audience of more than 4000 viewers joining from over 50 countries. Speakers and moderators comprised a variety of stakeholders ranging from global telco operators, vendors and academia to security organizations and other standards bodies.

Read More...




ess

ETSI Multi-Access Edge Computing extends services to WiFi to address enterprise needs

ETSI Multi-Access Edge Computing extends services to WiFi to address enterprise needs

Sophia Antipolis, 16 July 2020

The ETSI Industry Specification Group on Multi-Access Edge Computing, ISG MEC, has recently released ETSI MEC GS 028 to extend network information services to the world of WiFi and thus squarely into enterprises space.

Read More...




ess

ETSI C-V2X Plugtest achieves interoperability success rate of 94%

ETSI C-V2X Plugtest achieves interoperability success rate of 94%

Sophia Antipolis, 18 August 2020

ETSI has just released the report of its 2nd C-V2X Plugtests event organized remotely in partnership with the 5GAA the last week of July. The 81 remote participants benefited from ETSI’s remote lab to run their sessions in their own labs. Observers from different organizations witnessed the execution of 288 test sessions based on the ETSI test specification ETSI TS 103 600, and interoperability results were reported in the Test reporting tool. An overall interoperability success rate of 94% was achieved.

Read More...




ess

ETSI webinar on Standardization for EU competitiveness in a digital decade

ETSI webinar on Standardization for EU competitiveness in a digital decade

Register now!

Sophia Antipolis, 6 October 2020

ETSI and KREAB invite you to a high-level virtual debate on 28 October to discuss and share your ideas on a standardization strategy to stimulate EU competitiveness in the digital economy.

Read More...




ess

World Standards Day 2020: STANDARDS ARE ESSENTIAL TO PROTECT THE PLANET

World Standards Day 2020: STANDARDS ARE ESSENTIAL TO PROTECT THE PLANET

On 14 October 2020, CEN, CENELEC and ETSI, the three official European Standardization Organizations, join the international standardization community in celebrating World Standards Day. By focusing on the environment, this year’s edition aims to raise awareness on the potential of standards to help tackle the climate crisis.

Read More...




ess

ETSI Mission Critical Plugtests event achieves a 95% interoperability success rate

ETSI Mission Critical Plugtests event achieves a 95% interoperability success rate

Sophia Antipolis, 2 November 2020

ETSI is pleased to announce it has now released the Report of its fifth MCX PlugtestsTM remote event that took place from 21 September to 2 October 2020. Results of the testing sessions outline an interoperability rate of 95%, giving industry a reliable set of standards for successful implementations.

Highlights of this event included initial railway-oriented capabilities in 3GPP Release-15, such as functional aliases, multi-talker, helping Future Railway Mobile Communication System (FRMCS) move forward. 173 delegates from all over the world executed around 1350 test cases in 169 test sessions, interoperability results were reported in the ETSI Test reporting tool. Around fifty new test cases were developed for this event and will be added to ETSI TS 103 564.

Read More...




ess

ETSI’s CTO granted the prestigious award of Wireless World Research Forum

ETSI’s CTO granted the prestigious award of Wireless World Research Forum

Sophia Antipolis, 18 February 2021

During WWRF 45th meeting ETSI’s Chief Technical Officer (CTO), Adrian Scrase, has been granted the prestigious award of the Wireless World Research Forum in recognition of his significant contribution to the development of mobile communications standards, and for his longstanding support of the work of WWRF.

Read More...




ess

ETSI releases Middlebox Security Protocols specification for fine-grained access control

ETSI releases Middlebox Security Protocols specification for fine-grained access control

Sophia Antipolis, 2 March 2021

ETSI is pleased to announce a new specification, ETSI TS 103 523-2: Transport Layer MSP (TLMSP), Part 2 of the Middlebox Security Protocol (MSP) series, which defines a protocol for varied (fine-grained) access control to communications traffic. This specification was developed by the ETSI Technical Committee CYBER.

Read More...




ess

ETSI 6th MCX Plugtests event reports a success rate of 97.6%

ETSI 6th MCX Plugtests event reports a success rate of 97.6%

Sophia Antipolis, 16 December 2021

ETSI is pleased to release the Report of its sixth MCX Plugtests event. Organized with the support of the European Commission, EFTA, TCCA and UIC, it was held in hybrid mode from 8 to 19 November 2021, with LTE assisted testing at University of Malaga, Spain. Vendors had the possibility to send equipment to the University of Malaga (UMA) for participating in end-to-end testing. They could use the LTE test network available on the premises and rely on the UMA experts onsite to run interoperability test sessions on the network without being present.

Read More...




ess

ETSI launches new education programme for the next generation of ICT standards professionals

ETSI launches new education programme for the next generation of ICT standards professionals

Sophia Antipolis, 8 February 2022

ICT standardization plays an important role for interoperability and innovation and its practice remains a topic that is not easily accessible. To try to remedy this situation and prepare the next generation of standards professionals, ETSI has developed comprehensive teaching materials on education about ICT standardization. With this programme ETSI leads ICT standardization education, bringing the expertise of its global membership from various sectors.

Read More...




ess

MEC is ramping up with Phase 3 work on Multi-access Edge Computing

MEC is ramping up with Phase 3 work on Multi-access Edge Computing

Sophia Antipolis, 15 March 2022

Since the beginning of 2022 the ETSI MEC Industry Specification Group (ETSI ISG MEC) has moved forward with the on-going Phase 3 work, which is foreseen to help accelerate and enable more effective and fruitful collaboration with other organizations.

Read More...




ess

ETSI C-V2X Plugtests event achieves a 93% interoperability success rate

ETSI C-V2X Plugtests event achieves a 93% interoperability success rate

Sophia Antipolis, 21 April 2022

The 3rd ETSI C-V2X PlugtestsTM event, held in partnership with 5GAA and hosted by DEKRA from 28 March to 1st April, achieved a success rate of 93% of the executed tests, showing an extremely positive level of multi-vendor interoperability. 226 test scenarios were executed in a laboratory and outdoor environment for interoperability, with 80 people from 25 companies participating in onsite and remote testing. All results are available in the newly released Report.

Read More...




ess

ETSI selected for special Research session at 2022 EuCNC & 6G Summit

ETSI selected for special Research session at 2022 EuCNC & 6G Summit

Sophia Antipolis, 11 May 2022

ETSI is pleased to have been selected for a special session at 2022 EuCNC & 6G Summit, on 9 June 2022 in Grenoble, France. Entitled Research results impacting B5G and 6G through Standardization, it will be jointly chaired by Markus Mueck, Chair of the ETSI board RISE (Research, Innovation and Standards Ecosystem) group, and Riccardo Trivisonno, Chair of 6G-IA Pre-Standardization Working Group. The latter represents industry in the novel Smart Networks and Services Joint Undertaking (SNS-JU) which is Europe’s key funding framework for future 6G and related technology.

Read More...




ess

The ETSI Future Rail Mobile Communications System Plugtests event achieves a success rate of 95%

Sophia Antipolis, 13 June 2022

The 2nd FRMCS PlugtestsTM event, organized remotely by ETSI with the support of the European Commission, EFTA, TCCA and UIC from 16 to 20 May 2022, has concluded with a success rate of 95% of the executed tests.

ETSI Plugtests events are essential to ensure seamless access to mission critical services across different vendors’ products and implementations. The MCX ETSI Plugtests series is the first independent testing of public safety and other mission critical LTE services. The MCX services are the basis for the Future Rail Mobile Communications System (FRMCS), and tests are based on the MCX (collectively for MCPTT, MCVideo and MCData services) framework.

Read More...




ess

ETSI publishes a new White Paper on Multi-access Edge Computing security

ETSI publishes a new White Paper on Multi-access Edge Computing security

Sophia Antipolis, 28 September 2022

Members from the ETSI Multi-Access Edge Computing group (ISG MEC) have just published a new white paper, “MEC security; Status of standards support and future evolutions".

Read More...




ess

ETSI welcomes the strengthened role for NSOs in the decision-making process of European standards

ETSI welcomes the strengthened role for NSOs in the decision-making process of European standards

Sophia Antipolis, 19 October 2022

The EU member states' ambassadors today endorsed the final compromise text of the Amendment to regulation 1025/2012 with regard to the decisions of European standardization organizations concerning European standards and European standardization deliverables.

Read More...




ess

ETSI Mission Critical testing event reports a 96% success rate

ETSI Mission Critical testing event reports a 96% success rate

Sophia Antipolis, 16 December 2022

The capabilities of Mission Critical Push-to-Talk (MCPTT), Mission Critical Data (MCData) and Mission Critical Video (MCVideo) – together abbreviated as MCX services – were tested during the seventh MCX Plugtests™ from 07 November to 11 November 2022 at the University of Malaga (UMA). The MCX ETSI Plugtests series is the first independent testing of public safety and other mission critical services over LTE and 5G networks.

Read More...




ess

A successful European Standardization System

A successful European Standardization System

Sophia Antipolis, 20 December 2022

The European standardization system is a global success story. After the release of the European Standardization Strategy in 2022, it became clear that the work of standardization was growing in its role as an integral tool of the European Single Market.

Read More...




ess

ETSI Research Conference: Research and Standards on a successful journey

Sophia Antipolis, 10 February 2023

With more than 170 face-to-face attendees, coming from 30 countries, the three day ETSI conference on Maximizing the Impact of European 6G Research through Standardization came to a close on 8 February. The event provided a unique opportunity for the research community to come together with industry representatives and standardization experts to discuss future technology research and building stronger links to standardization.

Read More...




ess

ETSI Multi-access Edge Computing Consolidates Phase 3 Work

Leading to more effective and fruitful cross organization collaboration

Sophia Antipolis, 14 February 2023

In the last three months, ETSI ISG MEC has released its final Phase 2 specification (GS MEC 015, on Traffic Management APIs) and made significant progress on Phase 3 with the release of a number of important specifications, including the MEC Federation Enablement APIs (GS MEC 040): in particular, this specification is critical for supporting the requirements received from GSMA OPG (Operator Platform Group) to enable inter-MEC system communication and allow 5G operators to collaborate among themselves, with service cloud providers and with other stakeholders. 

Read More...




ess

ETSI Quantum-Safe Cryptography event: a success 10 years later!

Sophia Antipolis, 16 February 2023

The 9th face-to-face ETSI-IQC Quantum-Safe Cryptography event this week attracted a large audience of nearly 200 people from Europe, North America and Asia, bringing together industry, academia and government. The event was kicked off by ETSI Director-General Luis Jorge Romero, who gave an overview of the quantum-safe standardization journey since the first workshop in 2013 and reiterated ETSI’s continued support for this important global effort.

Read More...




ess

ETSI holds successful SDN NETCONF Plugtests interoperability event

Testing end-to-end service configuration of Millimetre Wave network devices in a Software Defined network using NETCONF

Sophia Antipolis, 8 March 2023

ETSI has organized the fourth millimetre Wave Transmission (mWT) Software Defined Networking (SDN) Plugtests™ event from 20 to 24 February 2023. The event took place at the ETSI headquarters, in Sophia Antipolis, France.

Read More...




ess

ETSI MEC meets vertical markets, helping the drones business

Sophia Antipolis, 23 May 2023

On 26 June 2023, ETSI will host the first panel of a series of Multi-access Edge Computing live panels. This panel will explore the drone business from a MEC perspective with a variety of speakers coming from this vertical market.

Read More...




ess

ETSI interop event for future rail communication reports a success rate of 86%

Sophia Antipolis, 1 September 2023

The Report of the 3rd interoperability Plugtests™ event for the Future Railway Mobile Communication System (FRMCS) is now available. All executed tests achieved an interoperability success rate of 86%.

Read More...




ess

ETSI releases standard for IT solution providers to comply with EU regulation on electronic signatures in email messages

Sophia Antipolis, 20 September 2023

ETSI has published a new standard on “Requirements for trust service providers issuing publicly trusted S/MIME certificates” (ETSI TS 119 411-6 ) helping Trust Service Providers comply with new standards for S/MIME certificates that are enforced since 1 September 2023. Secure MIME (S/MIME) certificates are used to sign, verify, encrypt, and decrypt email messages. 

Read More...




ess

ETSI Mission Critical testing event reports a 95% success rate

Sophia Antipolis, 22 November 2023

The Report of the eight MCX Plugtests™ event that took place from 9 October to 13 October 2023 at University of Malaga (UMA) is now available. The Report shows a success rate of 95% interoperability of the 3GPP mission critical services executed tests.  

Read More...




ess

ETSI Signs Pledge to Future Standardization Professionals

Sophia Antipolis, 30 November 2023

ETSI proudly announces its commitment to fostering the education and skills development of the next generation of European standardization professionals. This initiative is part of a voluntary pledge which ETSI’s Director-General Luis Jorge Romero signed today in Brussels in the presence of the Commissioner for Internal Market of the European Union, Thierry Breton. It was launched by the European Commission’s High-Level Forum on European Standardization, specifically under the workstream on Education and Skills.

Read More...




ess

ETSI Multi-access Edge Computing completed Phase 3 Work and started Phase 4

Sophia Antipolis, 15 April 2024

ETSI Multi-access Edge Computing completed Phase 3 Work and started Phase 4

Leading to more effective and fruitful cross organization collaboration

In the last three months, ETSI ISG MEC has released its final set of Phase 3 specifications and made significant progress on Phase 4 with the opening of new Work Items. In particular, the last Phase 3 version of MEC 011 (Edge Platform Application Enablement) contains the updates related to the latest alignment with 3GPP on CAPIF, thanks to a fruitful collaboration with SA6, CT3 and SA3 groups. Also, ISG MEC produced an updated version of MEC 040 (Federation Enablement APIs), that carefully considered the relevant work of other industry bodies relating to MEC federation and all relevant work done in ETSI. This work is critical for supporting the requirements from GSMA OPG (Operator Platform Group) to enable inter-MEC system communication and allow 5G operators to collaborate among themselves, with service cloud providers and with other stakeholders. New APIs are introduced for the enablement of MEC federation, helping operators to "federate" edge computing resources by offering their MEC service capabilities for mutual consumption, application developers and end-customers (e.g. vertical markets).

Read More...




ess

Preparing for a secure future: industry and business share plans for quantum era at 10th ETSI/IQC Quantum-Safe Cryptography Conference

Sophia Antipolis, 24 May 2024

Speakers at the 10th ETSI/IQC Quantum Safe Cryptography Conference have called on organizations to prepare their cybersecurity infrastructures to address the challenges of a post-quantum world.

Organized by ETSI and the Institute for Quantum Computing, this year’s conference was hosted from 14-16 May by the Centre for Quantum Technologies (CQT), National University of Singapore (NUS), in partnership with the Infocomm Media Development Authority (IMDA) and the Cyber Security Agency (CSA) of Singapore. The event attracted an impressive 235 onsite delegates from 27 countries, reflecting fast-growing interest worldwide in the critical importance of quantum-safe cryptography in today’s cybersecurity strategies.

Read More...




ess

ETSI and 5GAA driving interoperability as C-V2X tests hit a 94% success rate

Sophia Antipolis, 30 September 2024

Direct communications between vehicles, pedestrians and infrastructure based on 3GPP and ETSI TC ITS standards have been tested during the 4th C-V2X Plugtests™ interoperability event in Malaga, Spain, hosted by DEKRA (September 10- 13, 2024).

In partnership with 5GAA, this Cellular Vehicle-to-Everything (C-V2X) and ITS technologies event attracted the participation of 24 companies and 82 experts – both onsite and via remote connections – with 94% of the planned tests, based on over 60 test scenarios, successfully completed.

Read More...




ess

First-Time Home Buyer's Essentials

Starts: Tue, 10 Dec 2024 19:00:00 -0500
12/10/2024 05:30:00PM
Location: Montreal, Canada




ess

Vancouver: Professional Networking

Starts: Thu, 12 Dec 2024 09:30:00 -0500
12/12/2024 08:00:00AM
Location: Vancouver, Canada




ess

Notice of Coming into Force of National Instrument 93-101 Derivatives: Business Conduct

National Instrument 93-101 Derivatives: Business Conduct (the Rule) will come into force on September 28, 2024 (the Effective Date), pursuant to section 143.4 of the Securities Act (Ontario).




ess

Multilateral Instrument 93-101 Derivatives: Business Conduct

This document is only available as a PDF.




ess

Companion Policy 93-101 Derivatives: Business Conduct

This document is only available as a PDF.




ess

Assessing social media impact – a workshop at ScienceOnline #scioimpact

Assessing social media impact was one of the workshop sessions at November’s SpotOn London conference,




ess

SpotOn London Storify: Wikipedia editing session

Here is a Storify collecting the online conversations from the Wikipedia editing workshop at this year’s




ess

Policy Seminar | Debt Distress and the Right to Food in Africa




ess

Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)

  1. 4Critical
  2. 82Important
  3. 1Moderate
  4. 0Low

Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.

Microsoft patched 87 CVEs in its November 2024 Patch Tuesday release, with four rated critical, 82 rated important and one rated moderate.

This month’s update includes patches for:

  • .NET and Visual Studio
  • Airlift.microsoft.com
  • Azure CycleCloud
  • Azure Database for PostgreSQL
  • LightGBM
  • Microsoft Exchange Server
  • Microsoft Graphics Component
  • Microsoft Office Excel
  • Microsoft Office Word
  • Microsoft PC Manager
  • Microsoft Virtual Hard Drive
  • Microsoft Windows DNS
  • Role: Windows Hyper-V
  • SQL Server
  • TorchGeo
  • Visual Studio
  • Visual Studio Code
  • Windows Active Directory Certificate Services
  • Windows CSC Service
  • Windows DWM Core Library
  • Windows Defender Application Control (WDAC)
  • Windows Kerberos
  • Windows Kernel
  • Windows NT OS Kernel
  • Windows NTLM
  • Windows Package Library Manager
  • Windows Registry
  • Windows SMB
  • Windows SMBv3 Client/Server
  • Windows Secure Kernel Mode
  • Windows Task Scheduler
  • Windows Telephony Service
  • Windows USB Video Driver
  • Windows Update Stack
  • Windows VMSwitch
  • Windows Win32 Kernel Subsystem

Remote code execution (RCE) vulnerabilities accounted for 58.6% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 29.9%.

Important

CVE-2024-43451 | NTLM Hash Disclosure Spoofing Vulnerability

CVE-2024-43451 is a NTLM hash spoofing vulnerability in Microsoft Windows. It was assigned a CVSSv3 score of 6.5 and is rated as important. An attacker could exploit this flaw by convincing a user to open a specially crafted file. Successful exploitation would lead to the unauthorized disclosure of a user’s NTLMv2 hash, which an attacker could then use to authenticate to the system as the user. According to Microsoft, CVE-2024-43451 was exploited in the wild as a zero-day. No further details about this vulnerability were available at the time this blog post was published.

This is the second NTLM spoofing vulnerability disclosed in 2024. Microsoft patched CVE-2024-30081 in its July Patch Tuesday release.

Important

CVE-2024-49039 | Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2024-49039 is an EoP vulnerability in the Microsoft Windows Task Scheduler. It was assigned a CVSSv3 score of 8.8 and is rated as important. An attacker with local access to a vulnerable system could exploit this vulnerability by running a specially crafted application. Successful exploitation would allow an attacker to access resources that would otherwise be unavailable to them as well as execute code, such as remote procedure call (RPC) functions.

According to Microsoft, CVE-2024-49039 was exploited in the wild as a zero-day. It was disclosed to Microsoft by an anonymous researcher along with Vlad Stolyarov and Bahare Sabouri of Google's Threat Analysis Group. At the time this blog post was published, no further details about in-the-wild exploitation were available.

Important

CVE-2024-49019 | Active Directory Certificate Services Elevation of Privilege Vulnerability

CVE-2024-49019 is an EoP vulnerability affecting Active Directory Certificate Services. It was assigned a CVSSv3 score of 7.8 and is rated as important. It was publicly disclosed prior to a patch being made available. According to Microsoft, successful exploitation would allow an attacker to gain administrator privileges. The advisory notes that “certificates created using a version 1 certificate template with Source of subject name set to ‘Supplied in the request’” are potentially impacted if the template has not been secured according to best practices. This vulnerability is assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index. Microsoft’s advisory also includes several mitigation steps for securing certificate templates which we highly recommend reviewing.

Important

CVE-2024-49040 | Microsoft Exchange Server Spoofing Vulnerability

CVE-2024-49040 is a spoofing vulnerability affecting Microsoft Exchange Server 2016 and 2019. It was assigned a CVSSv3 score of 7.5 and rated as important. According to Microsoft, this vulnerability was publicly disclosed prior to a patch being made available. After applying the update, administrators should review the support article Exchange Server non-RFC compliant P2 FROM header detection. The supplemental guide notes that as part of a “secure by default” approach, the Exchange Server update for November will flag suspicious emails which may contain “malicious patterns in the P2 FROM header.” While this feature can be disabled, Microsoft strongly recommends leaving it enabled to provide further protection from phishing attempts and malicious emails.

Critical

CVE-2024-43639 | Windows Kerberos Remote Code Execution Vulnerability

CVE-2024-43639 is a critical RCE vulnerability affecting Windows Kerberos, an authentication protocol designed to verify user or host identities. It was assigned a CVSSv3 score of 9.8 and is rated as “Exploitation Less Likely.”

To exploit this vulnerability, an unauthenticated attacker needs to leverage a cryptographic protocol vulnerability in order to achieve RCE. No further details were provided by Microsoft about this vulnerability at the time this blog was published.

Important

29 CVEs | SQL Server Native Client Remote Code Execution Vulnerability

This month's release included 29 CVEs for RCEs affecting SQL Server Native Client. All of these CVEs received CVSSv3 scores of 8.8 and were rated as “Exploitation Less Likely.” Successful exploitation of these vulnerabilities can be achieved by convincing an authenticated user into connecting to a malicious SQL server database using an affected driver. A full list of the CVEs are included in the table below.

CVEDescriptionCVSSv3
CVE-2024-38255SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-43459SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-43462SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-48993SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-48994SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-48995SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-48996SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-48997SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-48998SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-48999SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49000SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49001SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49002SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49003SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49004SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49005SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49006SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49007SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49008SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49009SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49010SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49011SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49012SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49013SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49014SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49015SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49016SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49017SQL Server Native Client Remote Code Execution Vulnerability8.8
CVE-2024-49018SQL Server Native Client Remote Code Execution Vulnerability8.8
Important

CVE-2024-43602 | Azure CycleCloud Remote Code Execution Vulnerability

CVE-2024-43602 is a RCE vulnerability in Microsoft’s Azure CycleCloud, a tool that helps in managing and orchestrating High Performance Computing (HPC) environments in Azure. This flaw received the highest CVSSv3 score of the month, a 9.9 and was rated as important. A user with basic permissions could exploit CVE-2024-43602 by sending specially crafted requests to a vulnerable AzureCloud CycleCloud cluster to modify its configuration. Successful exploitation would result in the user gaining root permissions, which could then be used to execute commands on any cluster in the Azure CycleCloud as well as steal admin credentials.

Tenable Solutions

A list of all the plugins released for Microsoft’s November 2024 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.

Get more information

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.




ess

Social Media for Science Outreach – A Case Study: Lessons From a Campaign Twitter Account

James King is a geomorphologist interested in exploring the processes that govern sediment transport and




ess

OSC consults on improving retail investor access to long-term asset investments

TORONTO – The Ontario Securities Commission (OSC) today




ess

Canadian roundtable on audit quality addresses current state and trends

Toronto ─ On October 21, the Canadian Securities Administrators (CSA), the Canadian Public Accountability Board (CPAB), and the Office of the Superintendent of Financial Institutions (OSFI) co-hosted the sixth annual Canadian Audit Quality Roundtable.