Published: 2008-06-10
Microsoft pushed out seven patches on Tuesday, the day after Apple published five fixes for its QuickTime multimedia player.
The software giant released three Critical security bulletins, as well as three bulletins rated Important and one Moderate, fixing a total of 10 issues, according to Microsoft's Web site. Among the patches, the company fixed two flaws in Internet Explorer -- including an issue in the way the browser handles HTML objects -- in a cumulative update. Microsoft also patched two remote-execution flaws in its DirectX media library.
Perhaps the most interesting flaw involved the way Windows XP and Windows Vista handle Bluetooth service requests. An attacker could take control of a target's system by rapidly sending a large number of Service Discovery Protocol (SDP) packets, the software giant stated.
"People traveling with laptops are probably the most likely to have Bluetooth enabled," Tyler Reguly, a security engineer with network-security firm nCircle, said in a review of the month's patches. "Its important to keep in mind the limited range of Bluetooth, which is what, in my opinion, somewhat limits the severity of the vulnerability."
Apple also patched its QuickTime media player this week, closing five security vulnerabilities in the way the software handled various media files. Specially-crafted PICT, AAC and Indeo video files could be used to execute malicious code and compromise a user's system, the company said in its advisory.
Both companies provide automated update services to download the latest patches.
If you have tips or insights on this topic, please contact SecurityFocus.
Posted by: Robert Lemos
