DirectX Security Alert

Microsoft issued three security bulletins, today, one warning of a flaw in DirectX. The new alert updates a July 23 warning of a "critical" flaw. The security hole would allow a hacker to create a buffer overrun in, of all places, the Musical Instrument Digital Interface (MIDI). The updated alert, available here, increases the number of available patches, as the flaw affects about every DirectX version released in the last five years.

Another critical bulletin, here, addresses a buffer overrun flaw affecting Microsoft Data Access Components (MDAC). The new alert updates another from July 31. Apparently, Microsoft misidentified the earlier exploit.

A third critical alert, here, offers information on multiple Internet Explorer exploits and provides access to a cumulative patch.

The new alerts, particularly for MDAC, highlight the problems businesses face managing patches. Businesses that applied the earlier patch may need to do so again with the newer one. Microsoft's documentation is unclear on the matter, other than indicating the older patch "has been superceded" by the newer one.

Since all three alerts warn of critical flaws, I would recommend that Microsoft customers test and roll out the security fixes as quickly as technically feasible.

Posted by Joe Wilcox at August 20, 2003 05:16 PM