Microsoft sews patches on its patches

Microsoft has started to release patches for its patches.

A recent security bulletin issued by the Redmond giant announced that a fix released on 12 June, which addressed a flaw in the Remote Access Service (RAS) phone book in several versions of Windows, can stop users from making virtual private network connections.

A new patch has now been released to fix the problem caused by the first patch.

RAS provides dial-up connections between computers and networks over phone lines. It is delivered as a native system service in Windows NT 4.0, 2000 and XP, and is included in a separately downloadable Routing and RAS for NT 4.0.

All of these implementations include a RAS phonebook which is used to store information about security, telephone numbers and network settings used to dial remote systems.

According to the Microsoft warning a phonebook value is not properly checked, and is susceptible to a buffer overrun.

The overrun could be exploited to cause a system failure, or run code on the system with Local System privileges.

The revised patch can be found at the Microsoft Download Centre and will be soon available through Windows Update.