In association with heise online

20 June 2008, 16:04

Bluetooth - the patch that didn't patch

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Microsoft has released a new version of the patch to close the Bluetooth security hole in Windows XP SP2 and SP3. The version released on patch day did not do what it was supposed to, leaving systems vulnerable even after it was installed. According to Security Bulletin MS08-030, an error occurred when the Bluetooth service experienced a large number of service discovery protocol packets (SDP), permitting code to be injected and executed.

The new patch is already being distributed through Windows Update. The initial version of the patch for Vista fixed the security hole so it does not need updating. Microsoft is currently investigating how this error occurred. So far it seems that two separate instances of human error contributed.

See also:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit