Risk: Informational
One small typo in Microsoft's code caused the security vulnerability that prompted Microsoft to release an out of sequence patch.
A rogue ampersand created a security hole in a the MSVidCtl ActiveX control that hackers began exploiting in early July. A blog posting on Microsoft's Security Development Lifecycle (SDL) by Michael Howard, a security program manager at Microsoft, explained that the minor typo corrupted the code used by the ActiveX control. This in turn created a buffer-overflow bug.
Microsoft plans to update its fuzzing tools so that they are better at detecting this kind of error. It will also mandate the use of newer ATL code.