Microsoft Patches First Vista-only Security Flaw
Yesterday was Microsoft’s patch Tuesday and the company issued a number of security updates for both Windows Vista, XP and 2000 users. June’s release contains 6 new bulletins, 4 of which are listed as critical.
Together the six patches fix fifteen vulnerabilities found in a variety of Windows programs including Internet Explorer, Outlook Express, Windows Mail and, for the first time, a flaw unique to Windows Vista.
While previous patches have been issued for Vista, yesterday’s release marks the first time Microsoft has had to patch a flaw introduced by code in Vista. Pervious Vista patches applied to problems with legacy code. The MS07-032 update applies to Vista systems only and addresses a vulnerability in setting Access Control Lists, which could allow “information disclosure,” as the Microsoft advisory puts it.
Perhaps the most serious flaw in June’s batch of patches is a fix for a critical flaw in the SSL libraries used by Windows, which can be exploited via IE. The SSL vulnerability also affects non-Microsoft browsers like Firefox and Opera which call the SSL libraries included in the OS.
To update your system turn on the automatic update feature or head to the Microsoft Update site and downloading the patches by hand.
