The BugBlog Plus November 2006 by Company

BugBlog Plus Archives
Current month
Nov 06 by company
Nov 06 by date
Oct 06 by company
Oct 06 by date
Sep 06 by company
Sep 06 by date
Aug 06 by company
Aug 06 by date
July 06 by date
June 06 by date
May 06 by date
Apr 06 by date
Mar 06 by date
Feb 06 by date
Jan 06 by date
Jan 06 by company
Dec 05 by date
Dec 05 by company
Nov 05 by date
Oct 05 by date
Sept 05 by date
Aug 05 by date
July 05 by date
June 05 by date
June 05 by company
May 05 by date
May 05 by company
Apr 05 by date
Apr 05 by company
Mar 05 by date
Mar 05 by company
Feb 05 by date
Feb 05 by company
Jan 05 by date
Jan 05 by company
Dec 04
Dec 04 by company
Nov 04
Oct 04
Sept 04 by date
XP SP 2
Aug 04 by company
Aug 04 by date
Jul 04 by company
Jul 04 by date
June 04 by company
June 04 by date
May 04 by company
May 04 by date
Apr 04 by company
Apr 04 by date
Mar 04 by company
Mar 04 by date
Feb 04 by company
Feb 04 by date
Jan 04 by company
Jan 04 by date
Dec 03 by company
Dec 03 by date
Nov 03 by date
Nov 03 by company

Jump to the BugBlog archives (October 03 and earlier are public archives)

Dec 06
Nov 06
Oct 06
Sept 06
Aug 06
July 06
June 06
May 06
Apr 06
Mar 06
Feb 06
Jan 06
Dec 05
Nov 05
Oct 05
Sept 05
Aug 05
July 05
Jun 05
May 05
Apr 05
Mar 05
Feb 05
XP SP2
Jan 05
Dec 04
Nov 04
Oct 04
Sep 04
Aug 04
Jul 04
June 04
May 04
Apr 04
Mar 04
Feb 04
Jan 04
Dec 03
Nov 03
Oct 03
Sept 03
Aug 03
July 03
June 03
May 03
April 03
Mar 03
Feb 03
Jan 03
Dec 02
Nov 02

Cleveland-area blogs*:

Backup BugBlog

Economic Development Futures

*there are more blogs in Cleveland, these are just from people I've met or know. Some of the above are actually farther away, but are bloggers I've met here.

BugBlog

Adobe

There is a bug in an ActiveX control for Adobe Reader 7.0.x and Adobe Acrobat 7.0.x that may allow an attacker to crash a computer after opening a corrupt PDF. However, it only affects you if you click on a link within Microsoft Internet Explorer to view a PDF file. Adobe's suggested workaround is to delete the ActiveX control. This means you won't be able to view PDFs from within IE; however, you will still be able to open them in the stand-alone Adobe Reader or Acrobat. See http://www.adobe.com/support/security/advisories/apsa06-02.html for the details on how to delete the file, if you use IE.

If you've installed Adobe Acrobat Professional on your computer, but the icon for Convert to Adobe PDF suddenly is missing from a Microsoft Office application, the problem may be that Adobe PDF was put on the Disabled Items list within Office. View the list from within the Office application by going to Help, About and clicking on Disabled Items. If Adobe Acrobat PDF is on the list, click to Enable it. If this isn't the problem, Adobe has some other possible solutions at http://www.adobe.com/support/techdocs/333235.html.

Some problems with Adobe Acrobat 8 may be due to the Acrobat Preferences file getting damaged or corrupted. You can fix these problems by re-creating the Acrobat Preferences folder. However, Adobe points out that a lot of customized settings may get lost, or reverted to default, when you do this. See http://www.adobe.com/support/techdocs/333213.html for the details.

If you install Adobe Acrobat 8.x on Windows 2000 and Windows XP, you may start to run into a whole series of malfunctions. According to Adobe, one thing you want to do is make sure any older versions of Acrobat, or the Acrobat reader, have been uninstalled. Do this via the Control Panel's Add or Remove Programs applet. You may need to do it multiple times if a bunch of old versions show up on the list. Adobe suggests starting with the newest version and work your way to the oldest. However, they also suggest that you restart the computer after every uninstalled version. See the details for this or other troubleshooting steps at http://www.adobe.com/support/techdocs/333213.html.

If you are using a font management utility such as Adobe Type Manager or Extensis Suitcase, make sure you activate any fonts you may need before starting Adobe PageMaker 7.0.2. If you start PageMaker and then activate the fonts, you may get a font embedding error when its time to export your file to either PDF or PostScript.

Adobe has an updated Flash Player 9.0.28.0 that patches a security bug that affects Flash Player 7.x, 8.x, and 9.x. The bug lets remote attackers modify HTTP headers which could then lead to HTTP Request Splitting attacks. Users of Flash Player 7-9 should get the latest player at http://www.adobe.com/go/getflashplayer. Note that Microsoft also issued a security bulletin on the same day about Flash Player -- but this bulletin was about a bug in Flash Player 6, a bug fixed by Adobe two months earlier.

Apple

Try to charge your Second Generation iPod shuffle, and the status light may not change from orange to green as it should if you charge it for over two hours. See the procedure that Apple has at http://docs.info.apple.com/article.html?artnum=304800 for getting to light to change to green.

Apple says that some anti-spyware software running on Microsoft Windows computers may prevent iTunes 7.x software from installing correctly. When you try to update or restore your iPod, you may get this error message: An unknown error has occurred: 1413. Apple says to temporarily disable the anti-spyware software, then upgrade to iTunes 7.0.2.

If you plug your iPod (any model with a color display) into a Mac running iTunes 7 or later, you may see that the Restore button is grayed out. The wrong iPod icon may also be displayed. Apple says this is because the iPodDriver.kext file didn't load. See fix details at http://www.info.apple.com/kbnum/n61937.

If you have an Intel-based Mac, once you update to Mac OS X 10.4.8, non-administrative users may not be able to change their passwords. Apple says if this happens, you will need to install the Mac OS X 10.4.8 Combo Update. Get it at http://www.apple.com/support/downloads/macosx1048comboupdateintel.html.

Connect a bus-powered FireWire device to an Apple MacBook Pro, and the computer may not be able to recognize it. It won't appear in any menus where it should be, and you may not be able to get the device to work right. Apple says the device probably also came with an external power supply, and it isn't able to get enough power over the FireWire connect to work properly. The fix is simple -- plug in the power supply.

If you have a cell phone that is iTunes-enabled, and you are trying to sync the phone to your computer, you may end up with one of a number of error messages, such as
Failed to identify some USB devices. iSync was unable to identify some USB devices. Unknown errorMSMachErrorDomain - 536870201
Device is being updated by iTunes. (And the update never seems to finish.)
Device is not plugged in. (Even though you can see that it is.)
If you run into any of these problems, you may want to check out Apple's troubleshooting steps at http://docs.info.apple.com/article.html?artnum=301974.

The Apple Security Update 2006-007 for Mac OS X 10.3.9 and 10.4.8 includes bug fixes for some bugs in OpenSSL (Secure Socket Layers). These bugs may allow a malicious website to impersonate another trusted site, and may allow an attacker to run code on your computer. Apple rates these as critical bugs.

There is a bug in the Apple Mac OS X 10.3.9 and 10.4.8 WebKit that can be exploited by a malicious webmaster. By adding some code to their webpage, they could access deallocated objects. This could either crash your Mac or possibly allow hostile code to run. This has been fixed in the Apple Security Update 2006-007. Apple credits Tom Ferris of Security-Protocols for finding this bug.

Apple says there is a bug in the Samba server from Mac OS X 10.3.9 and 10.4.8. If Windows Sharing is turned on, the active connections list may get screwed up. This may let remote attackers create lots of connections, which could use up system resources and cause a denial of service attack. Apple notes that Windows Sharing is not turned on by default. They've fixed the bug in the Apple Security Update 2006-007.

There is a bug in the VPN server of Mac OS X 10.3.9 and 10.4.8 that may allow a malicious local user to create files or execute commands with system privileges. This happens because the VPN server doesn't clean up its environment. This has been fixed in the Apple Security Update 2006-007.

There is an integer overflow in the Perl application that ships with Mac OS X 10.3.9 and 10.4.8. Apple says the overflow could be exploited to get hostile code to run on the system. This has been fixed in the Apple Security Update 2006-007.

On an Mac OS X 10.4 computer, you can use iSync 2.0 to synchronize calendars and contancts with your iPod. However, once you've upgraded to the latest iTunes 7.0x, iSync may not be able to do the job. Apple says this is because iTunes will insist on taking over this function. See http://docs.info.apple.com/article.html?artnum=301374 for details on how to manage the synchronization.

If you are running Mac OS X 10.4.8 in Classic mode, and then you try to do a video chat in iChat, or use iSight, you may get an error message saying that your camera is in use by another application. Apple says you will need to restart your computer to get your camera to work.

The Month of Kernel Bugs website has posted details of a bug in Apple Mac OS X. Because of a bug in the way that Safari handles external DMG files, a malicious website may be able to launch a denial of service attack and possibly run hostile code against your computer. See a slightly more readable version of the details at http://secunia.com/advisories/23012/.

If you are going to use Apple Aperture, you won't be able to use it to access files on FAT32 formatted volumes. Apple says that it is best to use Mac OS Extended (HFS Plus) formatting. They also say to avoid file systems that are case-sensitive.

If your Mac OS X or Mac OS X server has an "unexpected restart" (what most people would refer to as a crash) you may see a duplicate mount point listed in your Volumes. The old mount point is still there, and a new one with the number 1 appended to it will also be there. See http://docs.info.apple.com/article.html?artnum=304031 for the steps needed to remove the duplicate.

Apple says that if you should not move or rename Backup 3 files that are on your hard drive or other storage media. The Backup 3 program isn't able to go looking for the files -- apparently it only knows to go back where it put the files in the first place. If you did move or rename them, just reverse your actions if you want to restore files. Apple also points out the obvious -- don't delete these files, you won't be able to restore the data.

Apple says that firmware for Intel-based Macs may not get displayed automatically by Software Update. You may need to install them manually. To see how to check what firmware your computer does have, and to see the newest firmware versions of the various Macs, go to http://docs.info.apple.com/article.html?artnum=303880.

There is a bug in the Apple Remote Desktop software that may allow local users to grant themselves elevated privileges. The bug appears to be in the code used to installing and upgrading the clients. Apple says this has been fixed in the Remote Desktop 3.1 upgrade. The client upgrade is at http://www.apple.com/support/downloads/appleremotedesktop31client.html and the Administrator update is at http://www.apple.com/support/downloads/appleremotedesktop31admin.html.

According to Apple, if you do an Archive and Install of a Mac OS X 10.4 computer, and you have Adobe software installed, you might have to re-activate the software. To find the various ways that activation of Adobe software might screw you up, see http://www.adobe.com/support/techdocs/331418.html.

The Apple QuickTime MPEG-2 Playback component will open an MPEG-2 movie that is greater than 4 GB in size. However, it will only play the first 4 GB of the movie. Just hope the ending wasn't crucial.

Apple says that their new optical Wireless Mighty Mouse uses a laser that does not operate in the visual light spectrum. Therefore, unlike many other optical mice, you won't see any light from it. That doesn't mean its not working. They also say that the laser has such a low voltage that it can't be harmful to vision (unless you actually poke the whole mouse into your eye.)

Apple says that when you try to send .Mac Webmail with a Mozilla Firefox browser, and the email has a large file attachment, don't click Close right after Send. According to Apple this may cause Firefox to crash. They say either don't close right away, or start using Safari, which doesn't have this problem.

There is a new SMC firmware update for Apple MacBooks running Mac OS X 10.4.7 and 10.4.8. This update is supposed to improve stability and also cure unexpected shutdowns, what outsiders (but not Apple) refers to as "random shutdown syndrome." Get the update at http://www.apple.com/support/downloads/macbooksmcfirmwareupdate11.html.

The people who brought us a month of daily browser bugs now are set up to bring a month of kernel bugs. The first one is a new bug in the Apple Airport driver for Orinoco-based Airport cards from 1999-2003 PowerBooks and iMacs. It is unpatched. This is different from the relatively notorius bug in wireless drivers that was discussed earlier this year in the Washington Post. The month of kernel bugs is at http://kernelfun.blogspot.com/.

AOL

Nothing this month

ATI

Nothing this month

Cisco

Cisco says their Cisco Secure Desktop (CSD) 3.1.1.33 and earlier software has three bugs that lessen security. One bug may leave information from an Internet browsing session using SSL VPN (Secure Socket Layer on a Virtual Private Network) on a computer after the session ends. Another bug will let users leave the Secure Desktop when they shouldn't, and then third lets local users gain extra privileges. Cisco has fix information at http://www.cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml.

There is a bug in the Cisco Security Agent Management Center 5.1 (CSAMC) if it has been configured to use a Lightweight Directory Access Protocol (LDAP) server for authentication. Supply a legitimate administrator username and a blank password, and you may be able to bypass authentication. Cisco has a workaround and a fix available at http://www.cisco.com/warp/public/707/cisco-sa-20061101-csamc.shtml.

Computer Associates

Nothing this month

EA

Nothing this month

General

Overnight, I got emails from Darren, Rickie, Aron, Malinda, Carmen, Rita, Erin, Belinda, Hilary, Young, Odell, Tammie, Logan, Carlos, Addie, Maribel, Zachary, and Tristan. (What, no Isolde?). They all come with the subject line of "It's [name] :)" and they talk about a hot stock that's certain to zoom up in price. There are no links in the email, so it's not a phishing attack, and there's no attachment. There's often a couple of lines of wire-service news copy at the bottom, to throw off the spam filters. This is just an old-fashioned stock tip scam, often referred to as a "pump and dump". People think they've received a hot tip, they buy the stock, pumping up its price. The scamsters, who bought the stock for pennies, dump it when the price goes up. Lucky me -- I got a tip on seventeen different hot stocks last night.

According to a report in The Register, hackers are now experimenting with hiding hostile code in video files. McAfee says they have found the W32/Realor worm in Real Media files. This worm includes a link back to a hostile website. Read the whole thing at http://www.theregister.co.uk/2006/11/16/movies_gets_malware/.

SANS has come out with their latest version of the Top 20 Internet Security Attack Targets, which they call "a consensus list of vulnerabilities that require immediate remediation." It's not a 1 through 20 list; instead its's broken into categories (operating systems, cross-platform applications, network devices, security policy, and a special section.) Each entry on the list, such as Microsoft Internet Explorer, will have multiple problems and patches listed. So if you are responsible for security, and don't have enough things to worry about, check out the list at http://www.sans.org/top20/.

Symantec reports that some people were able to carry out an phishing attack on MySpace by temporarily creating a MySpace page called http://www.myspace.com/login_home_index_html. At first glance, it would appear you were logging on to your MySpace page, and may have divulged your login credentials. MySpace closed down the page within a couple of hours. See http://www.symantec.com/enterprise/security_response/weblog/2006/11/an_imaginative_phishing_attack_1.html for the full story.

At the BugBlog, the spam that is coming in lately has been heavily weighted towards stock scams (guess you can call it stock scam spam). The Symantec Security Response blog looks at one particular example, driven by the Rustock.B rootkit. Read the details at http://www.symantec.com/enterprise/security_response/weblog/2006/11/spam_and_stock_specualtion.html.

The Internet Storm Center reports that a spoofed email that says it is from mcafee@europe.com appears as a warning message from McAfee with an attachment. Opening the attachment triggers a password stealing program. This Trojan horse program is being called Lafool.

Some malicious users edited a page on the German version of Wikipedia so that it contained links to malware that could infect users computers. They then sent out spam pretending to be from Wikipedia, that pointed to the bad page. While editors at Wikipedia fixed the page, they at first neglected to go back and fixed the archived version of the malicious page. Read more at http://news.com.com/2100-7349_3-6132733.html.

Google

There is a bug in the Google search appliance used on many web sites. The bug could be exploited to mount phishing attacks because you may be able to construct a link that looks like it points to a trusted site, such as your bank, while in reality it is sending you to Russia. Accord to C Net, Google has informed customers who use the search appliance, and will be rolling out a fix. There is nothing that a regular web surfer needs to do. Read the whole thing at http://news.com.com/2100-1002_3-6138744.htm.

If your screen is corrupted in Google Calendar, then Google suggests clearing out your browser's cache. After you do that, sign out of Google Calendar and then close your browser. Then start the browser back up, and log on to Calendar again. If you are really corrupted, you may have to do this a couple of times.

If you are trying to run Google Earth on a computer that's using the Symantec Norton Personal Firewall, you may be getting blocked from accessing the Google Earth servers. If that's the case, you need to tell Norton Personal Firewall to create an exception. If you aren't sure how to do that, see http://earth.google.com/support/bin/answer.py?answer=46191&topic=1138.

Try to import events into your Google Calendar from a large iCal or a CSV file, and you may get a 500 error message. Google says that if this happens, wait for up to ten minutes with your browser window open. After that, close your browser and start up a new browser session. Go to Google Calendar and see if your events made it in. If not, they suggest trying to import a smaller range of events. See http://www.google.com/support/calendar/bin/answer.py?answer=37825&topic=8566 for more links on how to import your events.

Google managed to send out the Kama Sutra worm in a mass mailing to their Google Video Blog email discussion list. Actually, it seems to have happened in three different postings to the list. Luckily, the W32/Kapser.A@mm worm is old enough that it is detected by most antivirus software.

Hewlett Packard

Nothing this month

IBM

IBM has a new cumulative update for the WebSphere Portal 5.1 Member Manager. The new fixes in this update include a fix for an incompatibility between SSL (Secure Socket Layers) and LDAP (Lightweight Directory Access Protocol) running in local mode. Get the update at http://www-1.ibm.com/support/docview.wss?uid=swg24009153.

If a vCard has an address with multiple lines, and you try to import the vCard into an IBM Lotus Notes client, the address will end up on one line with no spaces where the line breaks should be. IBM's advice is to manually edit the information once it is in Notes.

iDefense reports that there are a number of bugs in the IBM Lotus Domino 7 tunekrnl module for installation on Linux compuers. The bugs may allow buffer overflows that may allow local users to gain root privileges. IBM has fixed this in Domino 7.0.2. See more at http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21249173.

McAfee

McAfee reports that after you upgrade to Microsoft Internet Explorer 7, you will have problems updating McAfee Consumer 2006 products. By their count, you will see nine different yellow Information Bar warnings before you will be able to update their products. If you need help, McAfee has a 25 step workaround listed at http://ts.mcafeehelp.com/faq3.asp?docid=410052.

Microsoft

In Microsoft Access 2007, there is a 16-join limit to any queries you may want to construct. Try to make a more complex query, and you will see this error message: System Resource Exceeded The only workaround is to figure out a way to do your query so that you don't have more than 16 Join statements.

In Microsoft Internet Explorer 6, there was an icon on the toolbar that let you Read Mail. You may notice that it's not there in Internet Explorer 7 -- Microsoft went for a cleaner interface with a minimal set of controls by default. If you really want that button back, however, you can get it by customizing your toolbar. If you don't know how to do that, see http://support.microsoft.com/kb/926068.

Microsoft says that their Microsoft Agent software technology has a critical bug that may allow a hostile website to completely control your computer. To fall victim, you would need to visit a website that links to a malicious .ACF file. This is a Critical bug for Windows 2000 and Windows XP, and a Moderate bug for Windows Server 2003. There is information on a temporary workaround, plus links to a permanent fix, at http://www.microsoft.com/technet/security/Bulletin/MS06-068.mspx. If you really aren't that familiar with Microsoft Agent (I wasn't) you can learn about it at http://www.microsoft.com/msagent/default.asp.

Microsoft has changed the behavior of Excel 2007 when you save to HTML formats. In older versions of Excel, when you did a Save as HTML command, some Excel-only features were saved with the file. That's no longer the case in Excel 2007. Excel-specific tags won't be saved. However, enough information will be saved so that it should display correctly as HTML. (Or at least as bloated as Office documents usually appear when saved to HTML.)

In Microsoft Excel 2007, you can include a hyperlink to a password-protected workbook. Unfortunately, if you type in the wrong password you may cause Excel to hang. So in addition to not opening the password-protected workbook, you are apparently locked out of the workbook that you already had open. However, Microsoft says that, although the cursor is an hourglass, if you click once on the File menu, the hourglass will disappear, and you can click Exit. You will be prompted to save any opened files, so you should be able to save all your work.

Microsoft has dropped the Microsoft Script Editor from Excel 2007 -- it's not supported.

The Month of Kernel bugs says that the Microsoft Windows kernel has one (a bug, that is.) A bug in the GDI kernel structures may let a local user trigger a denial of service attack leading to a Blue Screen of Death, or possibly run their own code that will let them gain Administrator privileges. Cesar Cerrudo gets credit for finding this bug.

If you are trying to use the AI Squared ZoomText Magnifier and MagReader 9.x with Microsoft Internet Explorer 7 and you are having problems, make sure to update to ZoomText 9.04 at http://www.aisquared.com, which Microsoft says is a free upgrade.

There is a policy setting for Microsoft Internet Explorer 7 to Turn off smart image dithering. However, if you check, or turn on, this option Microsoft says you actually get the dithering, which is the smoothing of jagged edges. It also interferes with the Smart image dithering checkbox in the Control Panel's Internet Options applet. Microsoft tries to sort all this out at http://support.microsoft.com/kb/925260.

Microsoft Internet Explorer 7 may have some problems with older versions of the Freedom Scientific JAWS 7.1 screen reader. While it can display most of a page, it may not be able to show drop down menus on a webpage. The updated JAWS8, which should be released soon, will fix this.

Once you have installed Microsoft Internet Explorer 7, you must take special precautions before you do a Windows XP repair installation. If you don't, you will break Internet Explorer. (Probably because the repair installation will write a whole bunch of older IE 6 DLL files.) Microsoft says you must uninstall IE 7 before doing the repair installation -- assuming your computer is functioning well enough for that. After the repair, you can reinstall IE 7. Read the details from Microsoft at http://support.microsoft.com/kb/917964/.

Tech Republic has an article called "10 Things You Should Know About Internet Explorer 7 Security". If you are bound and determined to stay with IE 7 instead of switching to Firefox, it's worth a read at http://articles.techrepublic.com.com/5100-1009_11-6130844.html.

The Internet Storm Center reports that Microsoft Internet Explorer 7 is now being considered a high priority update via Windows Update. Thus, any of you with updates set automatically should be getting IE 7 the next time your Windows XP computer checks in with the update server.

US-CERT is reporting that Microsoft Internet Explorer may let let remote attackers cast doubt upon valid security certificates. This could be used to disrupt communications between a browser and a secure site. At this point, there is no fix nor workaround. Keep an eye on http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-5913 for updates.

Microsoft has confirmed that a bug in Internet Connection Sharing (ICS)may be exploited to turn of the Windows XP firewall. ICS is not used much anymore, since it is an Internet sharing technology for dial-up users, most of whom don't have a network that needs the sharing. Read more at http://www.eweek.com/article2/0,1895,2048204,00.asp.

Microsoft Internet Explorer 7 is now being released in localized versions. The languages in the initial batch are German, Japanese, French, Spanish, and Finnish. You can get them via the Internet Explorer website right now at http://www.microsoft.com/windows/ie/downloads/default.mspx. Their releases will be staggered via Automatic Update over the next couple of months.

Some scripts on a web page that use a certain technique will not work correctly with Microsoft Internet Explorer 7. According to Microsoft, the problem comes when a child container HTML element tries to modify its parent element. This won't work in IE 7. The only fix is for the web page or web application to be re-written. See http://support.microsoft.com/kb/927917 for details.

Microsoft has issued a new Cumulative Security Update for Microsoft Internet Explorer 5.5 and 6. In addition to holding all the past bugs, this update also fixes bugs in the DirectAnimation ActiveX Control, and also a bug in HTML Rendering. All the bugs, if exploited by hostile web sites, may corrupt a computer's memory, and allow the attacker to take control. Get the patch at http://www.microsoft.com/technet/security/Bulletin/MS06-067.mspx. Microsoft credits Sam Thomas, with TippingPoint, and the Zero Day Initiative, for finding these bugs.

Microsoft has issued a patch for the Critical security bug for XMLHTTP ActiveX control that is in Microsoft XML Core Services. Exploit code for this bug has been circulating, and the BugBlog Plus noted the problem on 11/6). An attacker could design a webpage that could use this bug to take complete control of a computer. Microsoft has the patch at http://www.microsoft.com/technet/security/Bulletin/MS06-071.mspx. They credit Robert Freeman of ISS and Dror Shalev and Moti Jospeh of Checkpoint for finding the problem.

Microsoft says that a bug in the Workstation Service opens up a Critical security vulnerability in Windows 2000, and a Low security vulnerability in Windows XP Service Pack 2. (Only a user with Administrative privileges could exploit the bug in Windows XP SP2, and if they've an Administrator, they can pretty much do what they want anyway.) They have patches available at http://www.microsoft.com/technet/security/Bulletin/MS06-070.mspx. Microsoft credits eEye for finding this bug.

Microsoft has issued a Critical security bulletin for the Adobe Macromedia Flash Player 6, which ships with Windows XP Service Pack 2 and with the Windows XP 64 bit Professional edition. This bulletin is actually for the same bug that Adobe patched on 9/12/06 (and written in the BugBlog on 9/13.) If you didn't patch this bug back then, you can get the patch now from Microsoft at http://www.microsoft.com/technet/security/Bulletin/MS06-069.mspx.

Microsoft says there are bugs in Client Services for NetWare that may allow a remote attacker to take control of your computer. The bugs affect Windows 2000, Windows XP Professional, and Windows Server 2003, but does not affect the Home edition of Windows XP. Client Service for NetWare is also not installed by default, and will probably only be running if the computer is part of a Novell network. Get the patch at http://www.microsoft.com/technet/security/Bulletin/MS06-066.mspx. Peter Winter-Smith of NGS Software and Sam Arun Raj of McAfee are credited with finding these bugs.

Another reason to install the MS06-070 Security Bulletin that fixes a bug in the Windows 2000 Workstation service. Microsoft has posted a security advisory saying that code that can be used to exploit this bug is being circulated. Applying the patch from MS06-070 works against this code.

Microsoft has issued a Security Advisory about a bug in the XMLHTTP 4.0 ActiveX Control. This control is part of Microsoft XML Core Services 4.0 on Windows, which should be present on Windows 2000, Windows XP, and Windows Server 2003 computers, even if the users don't know it. However, Windows Server 2003 users running with Enhanced Security Configuration on will not be vulnerable. An attack could be mounted if you browse to a maliciously designed page, resulting in hostile code running on your computer. Microsoft is working on a patch which will be coming in a future Patch Tuesday. Read the details at http://www.microsoft.com/technet/security/advisory/927892.mspx.

There is a bug in the Microsoft WMI Object Broker ActiveX control that is included in Microsoft Visual Studio 2005. If you are using Internet Explorer 7 with the default security settings you are safe; you are also safe if you are running Visual Studio 2005 on Windows Server 2003 with Enhanced Security. Everyone else using IE 6 may be at risk. You would need to visit a malicious web page that exploits this to be at risk. Microsoft will probably have a patch ready on November's Patch Tuesday. The Internet Storm Center has a workaround at http://isc.sans.org/diary.php?storyid=1813. Microsoft's security advisory is at http://www.microsoft.com/technet/security/advisory/927709.mspx.

If you use Microsoft Windows Media Player 11 to download digital content from URGE, the program may lock up temporarily if you have a slow Internet connection. Microsoft says that if this happens often, go to your Internet Properties dialog box, Connections tab, LAN settings. Once there, uncheck the Automatically detect settings check box.

If you are running Windows Live OneCare, then you will need to jump through a few extra hoops if you want to share digital media content, such as with a media receiver. You'll need to open up some ports in the OneCare Firewall -- see how to do that at http://www.microsoft.com/windows/windowsmedia/player/11/readme.aspx#1835189.

Microsoft Outlook 2007 has an option called "Make all my pictures smaller." Unfortunately, Microsoft says that if you select that option before you add it to an Outlook email message, it won't work. The picture will go out in its full, inbox-clogging size. For now, their only workaround is to reduce the picture size using image-editing software. (In other words, ignore the Outlook command.)

If you use Microsoft OneNote, and you are upgrading to Microsoft Office 2007, you should sync up all your notebooks before upgrading. Microsoft says the file format in the shipping version of OneNote 2007 is different, and it will affect the offline cache. If you don't, there's a chance you'll screw up your files.

Microsoft Office 2007 has now been officially RTM (Released To Manufacturing) so we will start covering bugs and incompatibilities. According to Microsoft, after you install the Microsoft Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats, you may not be able to open an Office document from Windows Explorer. Instead, you will get a Save As dialog box. Microsoft says the compatibility pack breaks file associations between the file formats and their applications, such as .DOC and Microsoft Word. As a workaround, you will need to re-associate the file types with the applications. If you don't know how to do that, see http://support.microsoft.com/kb/927223.

Microsoft Office 2007 is incompatible with some of the features of SQL Server 2005 Business Intelligence Development Studio and Management Studio. Microsoft says these things won't work after moving to Office 2007: BIDS Cube Designero Calculations tab Actions and KPI tabs (when MDX syntax check is invoked) Perspectives and Translations tabs (when calculations are present in the cube) BIDS Reporting Services Project Wizard (when using Analysis Services data source); Calculated Member Buildero Query Builder; BIDS Report Designer (when using Analysis Services data source); Calculated Member Buildero Query Builder SSMS Analysis Services Role Editor (when MDX syntax check is invoked). See http://support.microsoft.com/kb/926421 for a hotfix that will take care of the problems.

Microsoft says that when you install Office 2007, the installation process will remove the Microsoft Office Web Components if you've installed them with a previous version of Office (whether you want that or not) . You'll need to go to the Microsoft Office Download Center and get the Office 2003 or Office XP Web Components and install them again.

If you are using Microsoft Outlook 2007, and you also have Microsoft Office SharePoint Server 2007 Web sites set up to use client certificate mapping, you may not be able to connect to the Calendar list from multiple website. Instead, you may get this error message 401 Unauthorized. Microsoft has a couple of workarounds for this at http://support.microsoft.com/kb/926964.

Charts created with the stand-alone version of Microsoft Organization Chart 2.0 are not compatible with Microsoft Office PowerPoint 2007, although they were compatible with earlier versions of PowerPoint. If a PowerPoint presentation was created in an earlier version of PowerPoint and contained org charts, and then you opened the .PPT file in PowerPoint 2007, those charts will be OK. There is a new Organization Chart add-in, which Microsoft says is not a separate purchase, that you can use. See http://support.microsoft.com/kb/926928 for details.

When you install Microsoft Office 2007 and choose the Upgrade option, all older versions of Office will be removed. If you don't want this to happen, you should choose Custom during the Office 2007 installation. That will let you choose whether to remove all the old versions, keep them all, or do something in between. See http://support.microsoft.com/kb/924618 for the details on how to do this.

If you get interrupted while installing Microsoft Office 2007, the best choice would be to allow the setup program to roll back to your initial state. However, sometimes that doesn't happen. Later, when you go to install again, you will be stopped with this vague error message 2007 Microsoft Office suite_name encountered an error during setup. The problem may be that the Rgstrtn.lck file was left on your computer after the failed installation attempt. You'll need to get rid of it. Microsoft shows how at http://support.microsoft.com/kb/927153.

You can construct Microsoft PowerPoint 2007 presentations that contain hyperlinks that can take you to various parts of your presentation, such as the first slide, next slide, or last slide. If you save the presentation as a PowerPoint 97-2003 file (to share with some unenlightened soul who hasn't upgraded), these hyperlinks may not work. There is no fix or workaround yet.

According to Microsoft, when using Windows Media Player 11 you won't be able to synchronize album art for some devices. For now, this list includes the Samsung YP-Z5 MP3 Player, the SanDisk Sansa e200 Series MP3 Players, and the Philips GoGear family MP3 Players.

Microsoft has officially finished Vista, as they have announced that it has "gone gold" and that it has been RTM, which means "Released to Manufacturing" and not "Read the Manual". That means that you'll start to see bug items and incompatibilities here in the BugBlog. They won't be first-hand, however, since at this time I have no plans on making Windows Vista part of my life.

You cannot go to a command prompt in Windows Vista and use the runas command to run Internet Explorer 7 as a different user. Microsoft says that IE 7 won't support runas in Vista. The workaround is to switch to the other user account you wanted to use, via the Switch Users account, and then use IE 7.

According to Microsoft, after you use Windows Vista to change a computer's name, other computers will still be able to use the old name to connect to it. However, Microsoft says this is a temporary situation, and only happens when the DNS Windows Internet Name Service uses the computer NetBIOS name. Their only workaround is to have patience. Eventually the old name gets dropped from all the places where it may be cached.

If you have upgraded to Microsoft Windows Vista, and you need to restore an Office Outlook 2007 Business Contact Manager database, you will need to be running Outlook as an Administrator.

If you are running Microsoft Office Outlook 2007 on a Windows Vista computer using elevated user rights, you will not be able to index or search email messages. According to Microsoft, SearchProtocolHost.exe process used in the indexing/searching can't handle the user rights for the .PST files in Outlook. For now, there is no fix nor workaround.

Microsoft eliminated a number of file import filters for some really old file formats. According to Microsoft, Excel 2007 won't be able to open or save in these formats: WK1 (1-2-3), WK4 (1-2-3), WJ3 (1-2-3 Japanese) (.wj3), WKS (1-2-3) WK3 (1-2-3), WK1,FMT(1-2-3), WJ2 (1-2-3 Japanese) (.wj2), WJ3, FJ3 (1-2-3 Japanese), DBF 2 (dBASE II), WQ1 (Quattro Pro/DOS), WK3,FM3(1-2-3), Microsoft Excel Chart (.xlc), WK1,ALL(1-2-3), WJ1 (1-2-3 Japanese) (.wj1) WKS (Works Japanese) (.wks). Chances are, if you've been plugging away on a DOS version of Lotus 1-2-3, I guess you aren't the type of computer user contemplating a jump to Office 2007.

If you install Microsoft Windows Media Player 10 on a computer after you have experimented and installed the Windows Media Format 11 runtime beta edition, you may run into problems with digital rights management. There will be some version mismatch between the files, and this descent into DLL Hell may cause Windows Media Player 10 to reject some files, saying you don't have the rights to play those files. If you've landed in this situation, see Microsoft's troubleshooting steps at http://support.microsoft.com/kb/926239.

Try to use a cellphone, connected by USB cable, to provide Internet access to a Windows XP Media Center Edition 2005 computer, and you may have problems. Either you won't be able to access the cellphone's memory card, or you won't be able to sync contacts between the computer and the telephone. Microsoft says this is because the caller ID feature of Windows XP Media Center Edition 2005 has a compatibility problem with the COM ports assigned to the modem. See fix information at http://support.microsoft.com/kb/925895.

Some older NVIDIA graphics drivers may have some problems if you are running Microsoft Word 2007 on a Windows Vista computer. Once you maximize the window in which Word is running, the Minimize, Restore, and Close buttons may no longer work. According to Microsoft, NVIDIA drivers from before 2003 may have this problem. (In Microsoft's defense, you probably don't want to try running Vista on hardware that old.) In any case, updated drivers may do the trick.

If you try to drag a slide from a Microsoft PowerPoint 2007 presentation into a Word 2007 document, the slide won't get copied and you will get an error message: Word has encountered a problem If you try to drage it to a Publisher 2007 publication, the slide won't get copied either, and you won't get an error message. Microsoft has a couple of workarounds for this. See http://support.microsoft.com/kb/925423 for the details.

The Automatic Update keyboard shortcut in Microsoft Word 2007 will remove any table styles that may have been applied. That is how Microsoft designed the command. However, they also say that giving the command, which is CTRL+ALT+U, will also turn off the table gridlines. They actually didn't want that to happen. To fix it, you will need to manually change the table formatting. Microsoft gives the details at http://support.microsoft.com/kb/923565.

If you change the Normal.dot template in Microsoft Word 2007, and then cut and paste a table from one Word document into another one that uses Normal.dot, you may lose all the extra formatting you may have applied to the table. This would include things like bold, italics, and fonts. Microsoft's only workaround at the moment is to say you'll have to go back and re-apply the formatting.

Microsoft Word 2007 has a Picture Provider feature that lets you upload pictures from your hard drive to various destinations. However, Microsoft points out that you can't use this feature with the Blogger server. This is because Blogger doesn't support the full picture functionality.

Microsoft Office OneNote 2007 or Word 2007 may have trouble printing to some Lexmark and Dell printers. According to Microsoft, the problem is with these models: Lexmark Z700-P700, X1180, X1170, X1150, P706, and Z25; and the Dell A940 (Personal All-in-One). Try to print, and you may see this error message:
Prop Res DLL not loaded. Cannot load Library DLBAPRP.dll
It looks like Microsoft is hoping for a printer driver update, since they say to check with the printer manufacturer. Also see the workaround at http://support.microsoft.com/kb/918730.

If you open a Microsoft Word 2007 document that has macros, you will see a warning in your Message Bar. Once that happens, every time you open a document you will get that warning message, whether it has macros or not. Microsoft says this behavior will continue until you click on the Option to either enable or disable macros. After you do that, the message won't reappear until you open another document that has macros.

If a Microsoft Word 2007 smart document isn't stored in a secure location, then when you open the document you won't be prompted to install the XML expansion pack manifest file, which should happen. Microsoft says you will need to move the document to a trusted location. See how to do this at http://support.microsoft.com/kb/927010.

An old Microsoft Word bug, going all the way back to Word 2000, made the leap to Word 2007. If you have a paragraph with a double border in a Word document, save the document as a Web page, and the view it in Internet Explorer, the border will only be a single border. Microsoft says that you will have to format your borders so they are at least .75 points wide if you want them to show up as a double border.

According to Microsoft, Word 2007 does not support Excel 2007 chart objects that are bitmaps. That means you can create something in Excel 2007 that you won't be able to cut and paste into Word 2007. While both bitmaps and Microsoft Office Graphic Object aren't supported, you will be able to cut and paste Microsoft Office Excel Worksheet Objects and Windows Metafile pictures. See http://support.microsoft.com/kb/925590 for more.

Mozilla

The Mozilla Firefox Password Manager, in Firefox 2.0 has a bug that keeps it from correctly checking the URL of a web page when it automatically fills in your username and password. That doesn't make a difference if you are at a valid web site, but it may make you vulnerable to a phishing attack if you go to a malicious web site masquerading as a legit site. There is no fix yet.

Mozilla notes that they will continue to produce security and stability updates for Firefox 1.5.0.x through 4/27/2008. By that time, they probably hope everyone has upgraded to Firefox 2.0.

There is a bug in the way that Mozilla Firefox, Thunderbird, and SeaMonkey handle RSA digital signatures. If the signatures use a low exponent, they could be forged. Mozilla fixed this in Firefox 2, but the fix was incomplete in Firefox 1.5.0.7. They have come out with a bug fix release, Firefox and Thunderbird version 1.5.0.8, and SeaMonkey 1.0.6, to take care of this and a few other bugs. Mozilla credits Ulrich Kuehn for finding this bug.

Mozilla says that a bug in Firefox and Thunderbird 1.5.0.7 and in SeaMonkey 1.0.5 may allow a Script object to be modified while it is executing, which may allow an attacker to run their own code. Thunderbird is only vulnerable if JavaScript is enabled in email, which is not the default configuration. This has been fixed in Firefox and Thunderbird 1.5.0.8 and in SeaMonkey 1.0.6.

Mozilla says the Firefox and Thunderbird 1.5.0.8 release, and SeaMonkey 1.0.6 release, have a number of unspecified bug fixes that should make the programs more stable. Without the fixes, there was a possibility of crashes which could lead to memory corruption, as well as executing hostile code. Mozilla credits Jesse Ruderman, Martijn Wargers, shutdown, and Igor Bukanov for finding these bugs.

There is a bug in both Mozilla Firefox 1.5.0.7 and Firefox 2 that a remote attacker could use to trigger a denial of service attack that crashes the browser. First reports said that remote code execution was also possible for this bug, but testing by Mozilla hasn't been able to show that. You can read along as Mozilla works to fix this at https://bugzilla.mozilla.org/show_bug.cgi?id=358797

In Mozilla Firefox 2, there is no longer an option to disable third-party cookies. The viewpoint from Mozilla seems to be that there were so many ways to avoid these measures, that they had no real usefulness. There's an extended disucssion at Mozillazine over other ways to blocking these cookies short of an outright ban on all cookies. Read it at http://forums.mozillazine.org/viewtopic.php?t=478545&sid=dc67fdf31128b1926968063cd7f6247f

When using Mozilla Firefox 2.0 on an Intel-based Apple Mac OS X computer, some people are reporting problems playing Adobe Macromedia Flash content. Mozilla suggests either deleting or moving the PowerPC version of the Flash Player Enabler plugin from /Library/Internet Plug-Ins.

If you have more than 20 tabs open in Mozilla Firefox 2.0 running on a Mac OS X computer, the tab shortcut of "Close Other Tabs" may not work. You'll need to close the tabs one by one.

Netgear

The Month of Kernel Bugs website reports on a buffer overflow bug in the driver for the NetGear WG311v1 wireless adapter. If an attacker sends a long SSID (Service Set Identifier), they may be able to take advantage of the overflow to run hostile code on your computer. You can see the detailed original report at
http://projects.info-pull.com/mokb/MOKB-22-11-2006.html. There is no fix yet.

Novell

Novell says there is a buffer overflow in the Novell Client v4.91, that occurs no matter what level of Support Pack you have running. The bug is in nwspool.dll. You can get a patch for this (still marked as beta) at http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974765.htm.

Novell has released a kernel update for their Linux 2.4 kernel based distributions. The update fixes a number of bugs, including one that may allow remote attackers to trigger a denial of service attack. Another patched bug may allow local users to crash the kernel or run code as the kernel. See http://www.novell.com/linux/security/advisories/2006_64_kernel.html for details.

Security researchers at iDefense say there is a bug in Novell eDirectory 8.8 and 8.8.1 that remote attackers can use to crash the program and trigger a denial of service attack. eDirectory is vulnerable on both Windows, Netware, Linux and Solaris platforms. The Windows/NetWare patch is at http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974592.htm. The Linux/Unix patch is at http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974600.htm.

NVIDIA

If you have a NVIDIA GeForce 6600 128MB graphics card, and you are watching a DVD via Windows Media Player 10, changing the resolution may cause a crash. NVIDIA fixed this in the ForceWare 93.71 driver update.

There are a few unfixed issues with the new NVIDIA ForceWare 93.71 graphics drivers. If you switch the primary display, the S-Video-NTSC/HD Component format in the NVIDIA Control Panel is lost. You also won't be able to use the NVIDIA Multiple Display wizard if the nView multi-display mode is on.

If you have a NVIDIA GeForce 6800 Ultra 512 MB graphics card and want to use it with an Apple 30 inch HD Cinema panel, you won't be able to do it in SLI mode. According to NVIDIA, there is an incompatibility between the graphics card and the software that will interfere with the display. NVIDIA says to stick with non-SLI modes, according to the release notes.

Open BSD

Nothing this month

Oracle

Nothing this month

Red Hat

Red Hat has an updated PHP package for Red Hat Enterprise Linux 2, 3, and 4. This fixes an overflow bug in PHP that a remote attacker may be able to use to run code as the 'apache' user. The Hardened-PHP Project gets credit for finding the bug. Get the update at https://rhn.redhat.com/errata/RHSA-2006-0730.html.

Second Life

The virtual world Second Life was attacked by a worm that created shiny gold rings that showed up on the imaginary landscape. If the Second Life users' avatars touched the rings, they would replicate. Enough people did, and the Second Life servers bogged down until they were cleaned up by system administrators. Read about it at Slashdot at http://it.slashdot.org/article.pl?sid=06/11/20/0218221 or at the Second Life blog at http://blog.secondlife.com/2006/11/19/grey-goo-on-grid/. No word on whether this worm is being called Snow Crash(I've never been to Second Life, myself; my First Life is challenging enough.)

Sun Microsystems

Sun Microsystems says that the Nvidia Graphics driver for Solaris 10 and Linux running on the Sun Ultra 20 Workstation, Sun Ultra 20 M2 Workstation, and Sun Ultra 40 Workstation has a bug that may allow a remote user to trigger a buffer overflow and then run their own code as root. Sun has information on how to identify if your driver is at risk, as well as patch information, at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102693-1.

Symantec

Nothing this month

Ubisoft

Nothing this month

Winzip

There is a bug in WinZip 10.0 that may allow remote attackers to run their code on your system. This attack can be launched via a hostile web page. WinZip has released WinZip 10 build 7245 to fix this. Get it at http://www.winzip.com/wz7245.htm.

Wordpress

If you are a WordPress blogger, it's time to upgrade. WordPress has released WordPress 2.0.5, which has around 50 bug fixes. Some of the fixes tighten security, including in the wp-db-backup plug-in. You can get the upgrade at http://wordpress.org/download/.

Zone Alarm

Nothing this month