Microsoft's latest security update left Windows XP still vulnerable

Microsoft reissues June security fix

Redmond takes second crack at Bluetooth flaw

vnunet.com, 21 Jun 2008

Microsoft has reissued an ineffective security patch released earlier this month.

The patch was meant to address a remote code execution vulnerability in Windows XP and Vista which had been deemed 'critical' by the company.

Microsoft has now posted an update to its MS08-030 bulletin.

The original version of the patch posted on 10 June fixed the issue in Windows Vista, but left XP vulnerable. Windows 2000 and all Windows Server were not subject to either of the security bulletins.

"As soon as we learned of that possibility we mobilised our Software Security Incident Response Process to investigate the issue," said Microsoft security and response communications lead Christopher Budd.

"Our investigation found that, while the other security updates were providing protections for the issues discussed in the bulletin, the Windows XP SP2 and SP3 updates were not."

While the other security updates were providing protections, the Windows XP SP2 and SP3 updates were not

Christopher Budd Microsoft

The updated version of the patch can be obtained automatically through the Windows Update and Microsoft Update services. It can also be downloaded manually from the Microsoft Download Center website.