Microsoft's critical Bluetooth patch didn't work on XP

Microsoft has reissued a critical Windows security patch, saying that the fix didn't initially work on the most recent versions of Windows XP.

Microsoft learned of the problem after releasing its security updates last Tuesday, said Christopher Budd, a Microsoft spokesman, writing in a Thursday blog posting. "Our investigation found that while the other security updates were providing protections for the issues discussed in the bulletin, the Windows XP SP2 and SP3 updates were not," he wrote.

The patch, described in the MS08-030 security bulletin, fixes a flaw in the way Windows uses the Bluetooth networking protocol, used to connect peripheral devices like headsets to the PC. An attacker who got close enough to the Windows system to make a Bluetooth connection could theoretically send malicious packets to the PC and take complete control of a victim's computer.

Security experts say that because Bluetooth devices need to be within a few yards of a computer to connect, the flaw wouldn't be used in a widespread attack, but it is considered a serious bug.

Budd didn't offer much of an explanation for the error, saying that it looks like "two separate human issues" were to blame. "We’re beginning an investigation into how this happened."

Microsoft is now pushing out a new, working version of the patch via its automatic update mechanisms.

The IDG News Service is a Network World affiliate.