Microsoft and Apple issue critical patches

Microsoft and Apple released a batch of critical security fixes within 24 hours of each other, patching a variety of components including the Internet Explorer browser, Bluetooth services and the QuickTime media player. Three Microsoft patches were rated critical, the highest threat ranking in Microsoft’s four-tier scoring system. One purged IE of cross-domain and memory corruption vulnerabilities. Users could fall prey to them by visiting trusted websites that have been compromised by attackers. The Sans Internet Storm Center is urging people to apply the patch immediately, because details of the cross-domain bug have been public since March. A second critical patch from Microsoft fixes a bug in the Windows implementation of Bluetooth. An attacker can use it to execute malicious code by flooding a vulnerable system with a large number of Bluetooth device queries. This would be particularly useful for pwning a machine while in use at an airport or coffee shop, it seems.

Microsoft also issued a critical fix for buggy DirectX components. Not to be outdone, Apple on Monday fixed five vulnerabilities in QuickTime that allowed miscreants to execute malicious code by tricking users into opening booby-trapped pictures, video and sound files. The patch is available for both Macs and Windows machines, and like the Microsoft updates, should be installed as soon as possible. To our disappointment, today’s Patch Tuesday from Microsoft failed to neutralize a blended threat that confronts Windows users who browse sites with Apple’s Safari browser. Two weeks ago, Microsoft warned users to stop using Safari until the threat is finally removed.

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!