The BugBlog Plus
This is the subscription portion of the BugBlog. The first bug of the day listed is always the free bug available to non-subscribers, followed by the subscription-only bugs.
1/31/2007 Reliability Update for Windows Vista
Microsoft already has a reliability update for Windows Vista. It fixes a number of USB problems, including bugs that cause devices such as fingerprint readers or Windows Media Center remote controls to stop working. It will also fix a problem that prevents you from reconnecting a USB device after you use the Safely Remove Hardware option to turn it off. Get the update 925528 at http://windowsupdate.microsoft.com.
Apple points out that their AirPort Extreme base station works with USB storage devices. However, it does not work with USB devices that have removeable media. That would include things like a USB-connected floppy drive. (But hey, floppies are heading to the scrap heap anyway.)
Cisco says that any of their devices which run IOS and which support voice are vulnerable to a denial of service bug if they aren't configured for Session Initiated Protocol (SIP). Cisco says that SIP is turned on by default for their voice devices. They have fix information at http://www.cisco.com/warp/public/707/cisco-sa-20070131-sip.shtml.
IBM says you should think twice before trying to use their WebSphere Application Server version 6.0.2.17 in a WebSphere Portal versions 6.0.0.0 and 6.0.0.1 environment. There appear to be compatibility problems in install and clustering functions. Keep an eye on http://www-1.ibm.com/support/docview.wss?uid=swg21254233 to see if IBM gets the problem fixed.
If you are running Windows Vista on a computer that has two GB or more of RAM along with a nVidia nForce EHCI controller, you may see this error message:
STOP 127 PAGE_NOT_ZERO_NVIDIA_USB.
Microsoft says this can be fixed with the reliability update 925528 for Vista that you can get at http://windowsupdate.microsoft.com.
Windows Vista comes with Windows Error Reporting, which can send problem reports back to Microsoft. It is supposed to ask for permission before it phones home, but Microsoft says the every once in a while a report goes out without asking first. Microsoft has fixed this with update 930857 that you can get at http://windowsupdate.microsoft.com.
Microsoft says that after you add media to the Xbox 360 Media Center Extender library, the media won't show up right away. That's because the list isn't updated until all your media has been downloaded. Depending on how much you add, this could take a couple of hours. See http://support.microsoft.com/kb/932158 for more.
Microsoft has added a Startup Repair tool to Windows Vista. This can be used to diagnose Stop errors that occur when the computer is booting up, or if it locks up. See more about the tool at http://support.microsoft.com/kb/925810.
If a Windows Vista computer has a Silicon Image SiI Parallel Advanced Technology Attachment (PATA) chip, it may not be able to see an optical drive that allows burning of CDs or DVDs. Microsoft has a hotfix for this, which will be in a future service pack. If you need to get this fix right away, see http://support.microsoft.com/kb/930194.
If you turn on BitLocker Drive Encryption in Windows Vista, you may end up with this error message: Stop 0x0000007E. According to Microsoft, this error happens if some chipset drivers are installed on the computer before you turn BitLocker on. Microsoft has a hotfix for this, which will be in a future Windows Vista service pack. Need the fix right away? See http://support.microsoft.com/kb/930979.
After you attach a USB flash drive or other storage device to a Windows Vista computer, and the device won't show up in the Safely Remove Hardware list. (The same device, plugged into a Windows XP computer, will show up on the list.) Microsoft says this may happen if the USB device has an embedded USB hub, and there's another device plugged in that is marked as non-removeable. Microsoft says the only workaround for now is to wait till the computer is turned off before unplugging the device.
1/30/2007 TomTom is BadBad
A couple of viruses hitched a ride with TomTom Go 910 satellite navigation devices. TomTom says it was a "small number" of devices manufactured during September-November 2006. The devices have hard drives, and the win32.Perlovga.A Trojan and TR/Drop.Small.qp malware managed to sneak on. These are Windows malware, and while the Go 910 are Linux devices, you can connect them to your computer for backup and updates. TomTom says that antivirus software will work on the infected units. TomTom talks about it at http://www.tomtom.com/support/index.php?Language=1&FID=5327, while ZD Net covers the issue at http://news.zdnet.com/2100-1009_22-6154198.html.
Apple has released the AirPort Extreme Update 2007-001. This fixes an out-of-bounds memory read that a nearby attacker (close enough to be within the WiFi signal) could use to crash your system. Apple has the fix information at http://docs.info.apple.com/article.html?artnum=305031. Apple credits LMH for finding this bug.
Microsoft says that if Windows Vista is running on a computer that uses the Mobile Intel 945GM Express Chipset and the Microsoft Advanced Host Controller Interface (AHCI) chipset driver. You may have problems waking it up from sleep about 10 percent of the time. Microsoft says it is due to a bug in the ATAportDeviceBusy function. Microsoft has a hotfix for this, which will be in a future Vista service pack. If you need the fix right away, see http://support.microsoft.com/kb/929909.
Laptop Windows Vista computers may have problems waking from sleep to do network-related tasks. If the network is wireless, the computer may wake up and give you this error message: STOP 0x0000007E. Microsoft has a hotfix for this, which will be in a future service pack. If you can't wait for the fix, see http://support.microsoft.com/kb/930311.
You may have problems using a screen reader program with Windows Vista. Microsoft says the bug may occur when you open a common file dialog box to a WebDAV location. Microsoft has a Registry edit that should fix this. See the details, and important warnings about editing the Registry, at http://support.microsoft.com/kb/926822.
There is a bug in the Sun Microsystems Sun Java System Access Manager 6 and 7. The bug may allow attackers to run cross-site scripting attacks that could steal cookies or logon information. There is no workaround, but Sun has patch information at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102621-1.
1/29/2007 Vista Special Report
Should you upgrade to Windows Vista? In the words of a famous philosopher, Dirty Harry, "It all depends, do you feel lucky?" The BugBlog has gathered up all the Vista items from the past two months and added them to the Vista Special Report, which will be updated daily.
1/29/2007 AV Software Interferes with Windows Vista
Try to activate Windows Vista, and you may get an error message that includes one of these error codes:
0XC004D401 or 0x80080250
According to Microsoft, these codes show that there is an incompatibility between Vista and your antivirus software or your digital rights management (DRM) software. You'll have to upgrade that software before you can activate Vista.
This isn't a bugfix that ordinary users need to worry about, but the Internet Systems Consortium updated the BIND DNS server software to versions 9.2.8, 9.3.4 and 9.4.0rc2. This fixes two bugs that turned up early in 2007. The SANS Internet Storm Center has more at http://isc.sans.org/diary.html?storyid=2129.
Vint Cerf (who knows quite a bit about the Internet since he was one of its primary creators) was speaking over at the World Economic Forum in Davos, Switzerland. He says that botnets -- armies of computers taken over by Trojan horse programs, poses a serious threat to the Internet. Read the whole thing at http://news.zdnet.com/2100-1009_22-6154221.html.
There is a bug in CHMlib, an open source library that can be used to read Microsoft compressed HTML files, or CHM. This bug may let an attacker to design a CHM file that corrupts memory and write data to your hard drive. This has been fixed in version 0.39 of the program, found at http://www.jedrea.com/chmlib/. The bug was discovered by Sean Larsson of iDefense Labs.
If you have a Microsoft Office 2007 document in a shared folder on an international domain name (IDN) server, and the computer running office is a Windows Vista computer, you will be prompted twice for a username and password when you try to get the file from the shared folder. Microsoft says to click "Remember my password" when you give the information the first time.
There is a bug in Six Apart Movable Type 3.33 and earlier that may allow cross-site scripting attacks. This may allow attackers to steal cookies or login information from other sites. It has been fixed in version 3.34, which appears to still be a beta version. See more at http://www.sixapart.com/movabletype/beta/distros/MT-3.34-beta-Release-Notes.html.
1/28/2007 Intuit QuickBooks Problems with Windows Vista
It appears that Intuit QuickBooks 2006 is not compatible with Windows Vista. In this case, the blame appears to lie with Intuit, for QuickBooks uses some techniques in communicating via the Registry that violate Windows XP standards, much less the newer Vista. David Berlind covers this in a number of posts at http://blogs.zdnet.com/Berlind/?p=316 and earlier.
1/26/2007 Yet Another Word Zero-Day Bug
The Symantec Security blog is reporting yet another Microsoft Word zero-day vulnerability. (This would be the fourth that's currently unpatched, if you are keeping score at home.) This one is called Trojan.Mdropper.W, and it will open a back door onto your computer that attackers will use. See more at http://www.symantec.com/enterprise/security_response/weblog/2007/01/new_microsoft_word_2000_vulner.html.
Cisco says that any of their routers running Cisco IOS software and configured for IPv6 may be vulnerable to a denial of service attack. (Mobile IPv6 is not affected.) There is both workaround and fix information at http://www.cisco.com/warp/public/707/cisco-sa-20070124-IOS-IPv6.shtml.
If you are going to upgrade an existing Microsoft Exchange Server to Exchange Server 2007, you need to make sure there are no Exchange Server 5.5 servers in your forest. Any Exchange Server 2003 servers will need to be upgrade to Service Pack 2, and Exchange 2000 servers should be at Service Pack 3. Otherwise, expect some compatibility problems.
If you use the Microsoft Office 2007 Office Customization Tool (OCT) to customize your installation of Office 2007, changes to an Outlook 2007 profile may not be saved. Microsoft says this happens because the Outlook profile isn't saved when you use the Save As option within the OCT. As a workaround, don't use Save As, just use Save. See http://support.microsoft.com/kb/930888 for more.
If you are running a Microsoft Office 2007 application on a Windows Vista computer, and you try to print to a Dell printer, your computer may lock up. Microsoft does not specify which Dell printers have a problem, but they say to check with Dell for a new printer driver. You may also want to switch things so the Dell printer is not the default printer. Keep an eye on http://support.microsoft.com/kb/931408 for updates.
Windows Vista license packages check whether you are using a 32-bit version or a 64-bit version that is compatible with your computer hardware. If you try to install the x64 version of Vista on an x86 (32-bit) computer, you will see the error message: Cannot Install License Package. You'll have to switch to the correct version of Vista.
1/25/2007 Windows Vista Versus Your Startup List
The Windows Defender program may not like some of the items on the startup list on a Windows Vista computer. While your computer booting up, you may see a message over on the far right of your taskbar that says:
Windows has blocked some startup programs. Windows blocks programs that require permission to run when Windows starts. Click to view blocked programs.
Clicking will show you what's been blocked. (Chances are, they are older pre-Vista applications, especially if this is a computer you upgraded to Vista.) See http://support.microsoft.com/kb/930367 for various things you can do as a workaround.
1/24/2007 Apple Fixes QuickTime Bug
Apple has released a security patch for QuickTime 7.13 for both Mac OS X and Windows. Security Update 2007-001 fixes a bug that may allow malicious websites to run code on your computer via RTSP URLs. This is the first fix Apple has released for a bug from the Month of Apple Bugs website. You can get the fix from the automatic Apple Software Update, or from http://www.apple.com/support/downloads/.
The Month of Apple Bugs says there is a bug in the way that Mac OS X uses QuickDraw to handle some of the information within PICT images. An attacker may be able to exploit this to corrupt memory and cause a denial of service. It may also be possible to combine this with other bugs to get root priviliges on the computer. See http://projects.info-pull.com/moab/MOAB-23-01-2007.html for more.
Cisco says their IOS software has a bug in the Transmission Control Protocol (TCP) listener. A remote attacker may be able to use this bug to cause a memory leak, and ultimately a denial of service attack. Cisco has both workarounds and patch information at http://www.cisco.com/warp/public/707/cisco-sa-20070124-crafted-tcp.shtml.
The latest scheme of some Russian spammers is to send out email saying that if you transfer $1 to the spammer, they will take you off their email list. (And probably put you on another list.) Many of the messages are in Russian, but McAfee AVERT Labs has a translation at http://www.avertlabs.com/research/blog/?p=176.
Microsoft says the update to Internet Explorer 7 may cause problems for the wizard that lets you go online and order prints from pictures in you’re my Pictures folder. Apparently, the extra security that comes in IE 7 blocks the external web site from accessing the local files. Microsoft has a hotfix that will be in a future service pack. If you need the fix right away, see http://support.microsoft.com/kb/929548.
Try to use the Windows Anytime Upgrade to upgrade to another version of Windows Vista, and you may see this error message: Unable to open the license. Error Code: 0x8007000D. Error information: The data is invalid. There could be two causes for this error. Either data got corrupted during the download, or the Automatic Update Manager incorrectly formatted some XML. Microsoft has workaround information at http://support.microsoft.com/kb/930378.
There is a bug in the Xorg X Server in Sun Microsystems Solaris 9 and 10. Local users may be able to exploit this bug to gain the same privileges as the Xorg server (which may be root privileges.) Sun has a fix for Solaris 10, and is working on a fix for Solaris 9. Get the fix at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102780-1.
If you upgrade to Microsoft Exchange Server 2007 on an x64 version of Windows Server 2003, you may get some incompatibilities that could cause your store to crash. Microsoft has workaround information at http://support.microsoft.com/kb/918980.
1/23/2007 McAfee Takes Out Lotus Notes
After upgrading to McAfee VirusScan Enterprise 8.5i, you may have problems accessing your IBM Lotus Notes email. According to McAfee, things will be OK at first, but after a few hours working with Lotus Notes, you may see this error message:
You are not authorized to perform that operation.
After that, you won't be able to do anything in Lotus Notes, but you will be able to close the program. When you restart it, you will have access again, but you will hit the wall again after a few hours. The problem happens if you have VirusScan configured for Scan server mailboxes enabled. For now, McAfee says to disable both Scan all server databases and Scan server mailboxes. See http://knowledge.mcafee.com/article/573/7227825_f.SAL_Public.html for more.
If you select text in Adobe Illustrator that has opacity of less than 100 percent, you won't be able to copy and paste it over to Adobe After Effects 7. The Edit>Paste command will be grayed out in After Effects. Adobe says you will need to upgrade to After Effects 7.0.1. Get it either through Adobe Update Manager, or get it at http://www.adobe.com/support/downloads.
In Apple Mac OS X 10.4, you may not be able to put a burn folder (where you collect files to burn to a CD or DVD) on an NTFS-formatted disk voume. Apple says that in OS X 10.4, NTFS volumes are read-only. Apple says to use a HFS+ volume instead. See http://docs.info.apple.com/article.html?artnum=304940 for more.
There was a bug in Google's anti-phishing browser extension for Mozilla Firefox web browsers. The bug was discovered by security researchers at Finjan Inc., who told Google and gave them time to fix it before releasing the details. Read the full story at http://arstechnica.com/news.ars/post/20070122-8677.html.
If you install Microsoft Exchange Server 2007, don't be shocked to look into your error log and see many instances of Event ID 7005 there. Microsoft says this is by design, because the Microsoft Exchange Transport Log Search service won't find the local server on passive nodes, but it will keep on looking.
If you are installing Microsoft Exchange Server 2007, don't try to upgrade from pre-release versions such as Beta 2, unless you were part of one of the official beta programs such as the Rapid Deployment Program (RDP). If you weren't in the program, Microsoft says to uninstall all previous versions first, and then install the Release to Manufacturing (RTM) version of Exchange 2007.
1/22/2007 Microsoft Re-Releases Security Bulletin
Microsoft has re-released Security Bulletin MS07-002, which patched Critical security holes in Microsoft Excel. The reason they patched the patch was that the original did not fix the problem in Excel 2000 in the Korean, Chinese, or Japanese versions. The BugBlog's Asian readers can get the new version at http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx.
Apple says that Software Update may not automatically display all the available firmware updates for Intel-based Macs. You may need to get the updates manually from the Apple Support Download site. Apple has a page at http://docs.info.apple.com/article.html?artnum=303880 that lists the most recent firmware versions for all their models, which will help you determine if you need an update.
The Month of Apple Bugs site points out that Apple iChat AIM 3.1.6 (AOL Instant Messenger) has a bug that may allow remote users to trigger a denial of service or possibly run code on your computer. They show how it is done at http://projects.info-pull.com/moab/MOAB-20-01-2007.html.
There may be some compatibility problems between users trying to use the IBM WebSphere Portal 5.1.0.4 or 6.0.0.1 Rich Text Editor and Microsoft Internet Explorer 7. IBM has a patch for the WebSphere Portal at
http://www-1.ibm.com/support/docview.wss?uid=swg24014608 that should fix this.
Microsoft says that if you create a spreadsheet in Excel 2003 that has a chart with a data label that uses a drop shadow effect, the drop shadow may not appear when you open the spreadsheet file in Excel 2007. This may happen if you chart doesn't have a border or a fill. To fix it, you'll need to add one of those to your chart. Microsoft explains the details at http://support.microsoft.com/kb/930072.
If you install Microsoft Office 2007, and then decide to install at least one Office 2003 program afterwards, you may overwrite some Registry entries. At least one of these overwritten entries will break Windows Desktop Search 3.0, so that it doesn't search Outlook 2007 emails. Microsoft says you will need to do a Repair on Office 2007. They give a general explanation of the repair process at http://support.microsoft.com/kb/924614.
1/21/2007 Storm Worm Trojan Circulating Via Email
If you want information on the storms hitting Europe, stick to the Weather Channel. Do not open an email attachment that comes with the subject line "230 dead as storm batters Europe". If you do, you may end up with the Storm Worm Trojan Horse that opens a back door on your computer and will later steal data or send out spam. Read more at http://news.zdnet.com/2100-1009_22-6151414.html.
Apple says that you shouldn't move or rename any applications that were installed along with Final Cut Studio. In some cases they may still work, but in other cases you run the risk of confusing Final Cut.
Try to install Apple iTunes for Windows, and you may see this error message:
iTunesSetup.exe is not a valid Win32 application.
Apple says this may indicate that the installation file was damaged during download, or is incomplete. One thing that could cause this to happen is pop-up blocking settings. Apple says to turn these off before downloading iTunes. See http://docs.info.apple.com/article.html?artnum=304945 for more information.
If you use the Microsoft Windows Anytime Upgarde (WAU) to upgrade from one version of Vista to another version of Vista, you may not be able to uninstall that version of Vista and go back to where you were. Microsoft has a workaround for this at http://support.microsoft.com/kb/928900.
Microsoft says that unformatted DVD-RAM disks cannot be formatted by Windows Vista. However, Vista is able to reformat a DVD-RAM disk that has already been formatted. The only workaround is to make sure you buy pre-formatted disks.
Microsoft has a list of when third-party VPN (virtual private network) clients will be available for Windows Vista. These include clients for Aventail, Checkpoint, Cisco, Citrix, F5 Networks, Juniper Networks, NCP, Nortel, and SafeNet. At this point, the majority of them are unavailable. See http://support.microsoft.com/kb/929490 for the estimated dates.
If you are using Mozilla SeaMonkey 1.1, then you may have trouble with sending email attachments from within Microsoft Excel or Word, which use MAPI as a way of getting email programs to co-operate. According to Mozilla, there is a workaround. At the command prompt, give this command from within the SeaMonkey installation directory:
regsvr32 MapiProxy.dll
If you use Mozilla SeaMonkey 1.1 ot compose, forward or reply to an email message, you may end up with a mail composition window that doesn't work, and that won't close. Mozilla says to open another compose window, close it, and then go back and close the first one. They say everything should work after that. (If not, should we keep on opening new windows?)
1/18/2007 Java Bug Is Security Threat
There is a critical bug in the way that Sun Microsystems Java Runtime Environment handles GIF images. An attacker may be able to use this bug to raise the privileges of a Java applet. This could allow hostile code to run on a computer, outside the confines of the Java sandbox. Sun has updates at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1. They credit the Zero-Day Initiative and Tipping Point for finding this bug.
1/17/2007 The Zombies are After Symantec
It's not quite Night of the Living Dead, but an army of remotely controlled zombie computers are targeting computers running old versions of Symantec Client Security and Symantec AntiVirus Corporate Edition. You can read about the details at http://news.zdnet.com/2100-1009_22-6150560.html. Note that Symantec's consumer software, Norton Antivirus and Norton Internet Security, are not affected. Symantec actually patched the hole being used on 5/25/2006, so victims have had ample time to apply the fix. The original Symantec fix is at http://www.symantec.com/avcenter/security/Content/2006.05.25.html.
After you upgrade to Microsoft Internet Explorer 7, you may find that hyperlinks no longer work in Microsoft Internet Explorer. Microsoft has two different lengthy workarounds (one has 17 steps, one has 11) at http://support.microsoft.com/kb/929867/.
If you configure Windows Vista to use the BitLocker Drive Encryption feature, sometimes the encryption isn't completed when you find you have to go into the Windows Recovery Environment (Windows RE) or the Windows Preinstallation Environment (Windows PE). If this happens, Microsoft says you will run into very heavy hard drive activity. Microsoft has a workaround for this. See the details at http://support.microsoft.com/kb/926186/.
Oracle released their first quarterly security patch for 2007. This Critical patch fixes 51 bugs in at least twelve different products (depending upon how you lump together the various releases.) Get the details at http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html.
Red Hat has a kernel update for Red Hat Enterprise Linux 2.1. This fixes a bug in the ATM subsystem that may let a remote user trigger a denial of service attack by accessing socket buffer memory. Get the update at http://rhn.redhat.com/errata/RHSA-2007-0013.html.
Zone Labs has released the latest version of ZoneAlarm. The new version 7.0.302.000 appears to be more of a remodeling rather than a bug-fix. They say the product set-up is shorter and designed better. The product has some changes in the user interfact -- partly to get get the Check Point logos in there along with the ZoneAlarm logo. See the details at http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html.
1/16/2007 IE 7 Brings A Non-working Icon
Upgrade to Internet Explorer 7 on a Windows XP Service Pack 2 computer, and you may get a new icon on your desktop that says "Restore My Active Desktop". Click on it, and nothing will happen. Microsoft has a Registry edit that will let you remove the icon. (Apparently dragging it to the Recycle bin doesn't work.) See the details, and important safeguards when editin the Registry, at http://support.microsoft.com/kb/929200/.
The Month of Apple Bugs says that they found a number of binary files in the /Applications directory that are set to root, but are writeable admin group users. Some malware authors may be able to exploit this fact to do some privilege escalation or other bad things. Mac OS X 10.4.8 is vulnerable. They have details at http://projects.info-pull.com/moab/MOAB-15-01-2007.html, as well as workaround information.
Google says that if your browser's cache is full, it may interfere with Google Gmail. In particular, you may not be able to see attachments. The fix is simple - empty your cache. If you aren't sure how, Google has the details for the most popular browsers at http://mail.google.com/support/bin/answer.py?answer=8840.
You won't be able to make a serial cable connection or an infrared connection between a Windows Vista computer and another computer. Those connections just must be too old-fashioned, for Microsoft says Vista will only support Ethernet, WiFi, or a home phone network adapter (HPNA).
Microsoft Excel 2007 may lose track of its Undo settings in charts. According to Microsoft, if you create a chart, change the value of a data point, and then change the format of the chart, you will not be able to undo twice and get back to the original value for the data point. (Hope you remember what it was.) Microsoft's workaround information at http://support.microsoft.com/kb/930081 consists of ways of making sure you don't do this.
According to Microsoft, some audio applications are hard-wired to look for the audio components in Windows XP. When you try to run some of these applications on a Vista computer, you will have problems, since some of these components have new file names. For instance they say that if you are running Windows Media Encoder 9, and click Mixer, all you will get is an error message saying a component is missing. In this case, you can use the Windows Volume Control in place of the mixer. See http://support.microsoft.com/kb/930095 for other workarounds.
1/15/2007 Upgrading an Embedded Excel Chart is Buggy
If you upgrade a Microsoft Excel 2003 chart to Excel 2007, and the chart is embedded in a Microsoft PowerPoint 2003 presentation, data labels in the chart may get moved. According to Microsoft, this may make the chart difficult to read in PowerPoint. There is no workaround or fix yet.
When you make a FireWire connection between an Apple Mac OS X computer and a Canon ZR-40, ZR-45, or ZR-50 camera, and there is another FireWire device also connected to the computer, you may have problems with the connection. This may include dropped frames while importing, or error messages such as:
The storage device that you just removed was not properly put away before being removed from this computer.
As a workaround, disconnect the other device. See http://docs.info.apple.com/article.html?artnum=61603 for more.
There is a buffer overflow bug in Computer Associates BrightStor ARCserve Backup RPC Engine 11.5. It may be remotely exploitable and would allow attackers to run their own code on the servers. CA has updated the program to fix this bug. Get the update at http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp.
IBM says that neither Lotus SmartSuite nor Lotus Organizer will work with 64-bit versions of Windows Vista. This is due to incompatible legacy code in the Lotus products. They also say that while they haven't heard of any compatibility problems with the 32-bit version of Vista, they aren't supporting the Lotus programs on Vista.
There is a fully-working exploit that can take advantage of the Microsoft VML bug that was patched as part of Microsoft's Patch Tuesday release for January. This exploit was developed by an intrusion-detection company, who is selling their research to other researchers. That means it is time to patch, if you haven't done so already. See http://www.eweek.com/article2/0,1895,2082416,00.asp for the full story.
If you add a SmartArt graphic to any Microsoft Office 2007 program, and group the graphic with other objects, you won't be able to resize it correctly for printing. Microsoft says that when you print it, it will always come out as the original size. You will need to ungroup it, resize it, and then group it again.
1/13/2006 Bugs in Apple UFS Filesystem via DMG Files
The Month of Apple Bugs (MOAB) project has come up with a series of bugs in the UFS filesystem that can be triggered via DMG files (disk image files). At least one of the bugs can be remotely exploitable via Safari if the "opening safe files after downloading" option is turned on. These bugs occupy the #9 through #12 spot on the list at http://projects.info-pull.com/moab/. As workarounds, avoid DMG files from untrusted sources, and turn off that Safari option.
One of the main reasons black Apple MacBook computers cost $200 more than identical models in white (well, other than the fact that black looks so cool, and Steve Jobs always wears those black mock turtleneck shirts) is that the palm rest on those white models tends to discolor. Apple appears to be ending their denial, for they now say if your model is showing discoloration after some use to contact AppleCare at http://www.apple.com/support/contact/ for service.
Try to connect to the Apple iTunes Store with your iTunes software (either Mac or Windows) and you may see this error message: Cannot connect to the iTunes Store. An unknown error has occurred. Unknown errors have unknown solutions, but Apple has some troubleshooting steps that you can follow, at http://docs.info.apple.com/article.html?artnum=300870, that can help you connect. (After all, if you can't connect, you can't buy anything.)
Google says that their online Spreadsheet application is compatible, via export, with these other spreadsheet formats: Microsoft Excel .xls; comma separated values .csv; Adobe Acrobat .pdf; HTML; and Open Document spreadsheet .ods.
IT Security has a new paper out called "Understanding the Enemy: The Top 10 Nastiest Malware Trends". Read more about all the plans the bad guys have in store for you at http://www.itsecurity.com/features/nastiest-malware-trends-011207/.
Early adopters often pay a price when they buy a device before the marketplace decides what the standard will be. It appears from this story that risks are still there if you are in the market for high-definition DVDs. Feedback from the Consumer Electronics Show says there is as yet no winner in the HD DVD versus Blu-ray battle. Read more at http://www.siliconvalley.com/mld/siliconvalley/16437906.htm.
Many custom forms created in Microsoft Outlook 97 through Outlook 2003 may not work correctly in Outlook 2007. Microsoft points out some of the problems you may have if you upgrade, at http://support.microsoft.com/kb/929591.
iDefense Labs will be paying a bounty for bugs that can be exploited remotely to run code on Windows Vista or Internet Explorer 7.0. Bounty hunters have till 3/31/2007 to bring in the bugs, dead or alive. See http://labs.idefense.com/vcp/challenge.php#more_q1+2007%3A+vulnerability+challenge for the details.
There is a bug in the power management options for Windows Vista. According to Microsoft, if you set the "Allow the computer to turn off this device to save power" option for a USB root hub, the configuration information may be lost after you restart the computer. Microsoft's workaround is to turn on the USB selective suspend option. Find out how to do that at http://support.microsoft.com/kb/930312.
Microsoft says that if you have Windows Vista running on Lenova T60 or Z61t computers, you may have problems with the screen brightness if you put the computer into a low-power sleep state, and then wake it up again. This is more likely to happen if you adjusted the screen brightness before sleep, either using a function key or the Windows Mobility Center. See http://support.microsoft.com/kb/929249 for more details.
Try to play EA Sports Tiger Woods 2006 on a Windows XP computer with NVIDIA GeForce 8800 GTX or GeForce 8800 GTS graphics cards, and you may see flickering shadows. At this point, with driver version 97.92, there is no fix.
1/12/2006 Too Much Multi-Tasking for NVIDIA
According to NVIDIA, if you have GeForce 8800 GTX and GeForce 8800 GTS based graphics cards running on a Windows XP Media Center computer, and you try to burn a DVD while also watching TV, you may crash with a blue screen of death. They say this has been fixed in the ForceWare Release 95 driver version 97.92.
1/11/2007 Word 2007 Doesn't Like Org Chart Editing
Try to edit an organization chart from within Microsoft Word 2007 by double-clicking the chart, and you may get this error message:
The program used to create this object is OrgPlusWOPX. That program is not installed on your computer. To edit this object, you must install a program that can open the object.
Microsoft has three suggested workarounds. First, try editing it again; they seem to think it may work the second time; if that doesn't work, right click the chart and select Edit. If that doesn't work, then you'll need to install the Organization Chart Add-in. See how to do this at http://support.microsoft.com/kb/930080.
1/10/2007 Adobe Patches Acrobat 7.0.8 Holes
Adobe now has a patch for the security problems in Adobe Reader and Acrobat 7.0.8 and earlier versions. The bugs, which were in the 1/4 BugBlog, may allow both cross-site scripting attacks and the ability of the attackers to take over the victim's computer. Adobe's earlier advice was to upgrade to the Adobe Reader 8. They now have a patch that will fix version 7.0.8 of the Reader as well as Acrobat Elements, Standard, and Professional. (Good news for those latter users, since the upgrade from 7.0.8 to 8.0 will normally not be free.) Get the patch at http://www.adobe.com/support/security/bulletins/apsb07-01.html.
Adobe says there is a bug in ColdFusion MX 7, ColdFusion MX 7.0.1, ColdFusion MX 7.0.2 and JRun 4. A remote attacker may be able to send a command to a server running one of these programs that enables access to directory listings. Adobe has patch info at http://www.adobe.com/support/security/bulletins/apsb07-02.html.
It appears that one of the few features the new Apple iPhone doesn't have is a legal name. Cisco Systems said it would be filing suit against Apple, because they have held the registered trademark for iPhone since 2000. (But who wants to hear Cisco CEO John Chambers give a keynote address?) Read more at http://www.breitbart.com/news/2007/01/10/D8MIN5CO0.html.
If you are playing LucasArts Star Wars Empire at War Forces of Corruption, you may find that sometimes heroes would get taken out of play and never return. This has been fixed in the Version 1.1 update to the game. If you are losing your Jedi, make sure to get the patch at http://support.lucasarts.com/patches/EAWFOC1_1.htm.
After you install the MS07-003 Security Patch that fixes problems with Microsoft Outlook, you will no longer be able to use the Advanced Find feature to save you search results as Office Saved Search files (.oss). See http://support.microsoft.com/kb/925938 for more.
Don't connect a Windows Mobile device to a Windows Vista computer, unless that computer has the Windows Mobile Device Center installed on it. If you don't, Microsoft says you won't be able to add or remove programs on the device. You can download the Device Center from http://support.microsoft.com/kb/929659.
Microsoft has published the Windows Vista Security Guide, which is supposed to help you harden you Vista installations against attack. Reports are that both the National Security Agency and the NIST both helped with this report. Unfortunately, the report had to be re-released because of some errors. It comes with its own set of release notes to show what had to be changed. You can get it at http://www.microsoft.com/downloads/details.aspx?FamilyId=A3D1BBED-7F35-4E72-BFB5-B84A526C1565
There seems to be a driver problem with Sony USB hard disk drives. If the drive is locked, then Windows Vista cannot recognize it, and won't be able to access it. Microsoft says it's because the Sony drive is not sending the correct status codes, and you'll need to look to Sony for a driver update.
There is a bug in the Novell Access Manager Identity Server 3.x. It may be possible for attackers to exploit this to run cross-site scripting attacks. Novell has a patch to fix this at
https://secure-support.novell.com/KanisaPlatform/Publishing/143/3615264_f.SAL_Public.html.
1/9/2007 Critical Bug in IE 6 and 7
There is a bug in the Vector Markup Language (VML) in Microsoft Windows that can allow remote attackers to run hostile code on your computer. The vulnerability will occur via Microsoft Internet Explorer 5.5, 6, and 7, which means it affects Windows 2000, Windows XP, and Windows Server 2003. (Vista is unaffected.) Microsoft says this is a Critical Update, which you can get at http://www.microsoft.com/technet/security/Bulletin/MS07-004.mspx. They also have workaround information there, if you can't install the patch right away. Microsoft credits Jospeh Moti working with the iDEFENSE Contributor Program for finding this bug.
The daily bug from the Month of Apple Bugs(MOAB) actually is in a third party application. Unsanity LLC's Application Enhancer has a bug that may allow local users to gain root privileges in the system. The bug is present on Mac OS X 10.4.8 in Application Enhancer 2.0.2. The blog that accompanies discusses this some more at http://applefun.blogspot.com/2007/01/moab-08-01-2007-moab-08-01-2007.html.
Google says they are doing some planned maintenance on Google Groups on 1/9, and that some features may be missing for awhile. It appears that all the groups are there -- or at least all the groups where I'm a member. (And I really don't like to join any group that allows me as a member.)
While Microsoft released four security bulletins on 1/9, none of them address the three zero-day security problems with Microsoft Word. If I had to guess, the Word bulletin was one of the four that Microsoft pulled at the last minute. So Microsoft Word remains unpatched.
There is a bug in the way that Microsoft Excel handles malformed records within files. An attacker may be able to booby-trap the records in such a way that they could take complete control of the system. This is a Critical vulnerability in Microsoft Excel 2000. Later versions of Excel have more safeguards; while Excel 2002, 2002, and Excel 2004 for the Mac, it is only an Important vulnerability for them because of the extra confirmations it takes when opening files with active content. Microsoft has a patch for this at http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx. They credit Jie Ma of Fortinet Security Research Team for finding this bug.
There is a bug in the way that Microsoft Outlook searches through .oss (Office Saved Searches) files. If someone else sends you a maliciously designed .oss file that you search, they could take complete control of your system. This is considered a Critical security vulnerability in Outlook 2000, and an Important vulnerability in Outlook 2002 and 2003. Microsoft has a patch for this at http://www.microsoft.com/technet/security/Bulletin/MS07-003.mspx. They credit Stuart Pearson of Computer Terrorism for finding this bug.
Microsoft has released a security bulletin to patch a security hole in the Microsoft Office 2003 Brazilian Portuguese Grammar Checker. Microsoft does not say what kind of grammar flaw could trigger the bug (a Brazilian double-negative, possibly?), but they consider it an Important security patch. Those of you using the Brazilian Portugese version of Microsoft Office can get the patch at http://www.microsoft.com/technet/security/Bulletin/MS07-001.mspx.
1/8/2007 Some of Word's Galleries are Missing
A new feature in Microsoft Word 2007 is the Building Block Gallery. There is a content control with a drop-down list of galleries, but Microsoft says that not all the galleries are displayed. Some of the ones that aren't are the Bibliography, Watermark, and Cover Page galleries. At http://support.microsoft.com/kb/930201 they say this behavior is by design, but they don't say anything about how to see the missing ones.
If you change the primary scratch disk volume in Adobe Photoshop CS2 on a Mac OS X computer, the next time you open Photoshop you may see this error message: Could not initialize Photoshop because the disk is not available. Adobe says that you will need to ignore the volume's ownership to be able to get Photoshop to run. See how to do this at http://www.adobe.com/support/techdocs/333730.html.
If you are creating a DVD in iDVD 6 on a Mac OS X computer, you may hear sound when previewing the project within iDVD. However, while burning the disk the sound disappears, and you won't be able to hear anything when playing the disk on the computer or in a standalone DVD player. Apple suggests the first thing to do is upgrade to iDVD 6.0.1. If that doesn't work, delete any encoded assets that are in the project. See http://docs.info.apple.com/article.html?artnum=303550 for more.
The Month of Apple Bugs (MOAB) project reports on a problem within Apple DiskManagement 92.29 and in Mac OS X 10.4.8. Attackers may be able to set rogue permissions on the filesystem when using the diskutil tool. According to MOAB, this bug is being actively exploited. See http://projects.info-pull.com/moab/MOAB-05-01-2007.html for more.
If you try to repair a Microsoft Ofice 2003 program or update one of the programs, you may see this error message: Error 2908. An internal error has occurred. The first thing you should actually check is whether you have the latest version of the Microsoft .NET Framework installed. If not, upgrade to that first and see if the problem goes away. If you do have the most recent version, you may have to repair the .NET Framework. See http://support.microsoft.com/kb/929681 for the details.
There is a bug in the Sun Microsystems Java System Content Delivery Server 5.0 and 5.0 PU1, on both Solaris 9 and 10. Attackers may be able to exploit this bug to read sensitive information. See Sun's patch information at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102764-1.
1/6/2007 Four Upcoming Security Bulletins from Microsoft
January 9 is Patch Tuesday. At first, Microsoft reported there would be eight security bulletins released. However, they have pulled four of them, and now say they will release only four -- one for Windows and three for Microsoft Office. You can read Microsoft's statement at http://www.microsoft.com/technet/security/bulletin/advance.mspx. You can read about the backtracking at http://news.zdnet.com/2100-1009_22-6147705.html.
An update to the 1/4 BugBlog item: Adobe now has a bulletin at http://www.adobe.com/support/security/advisories/apsa07-01.html. The original bug report: There are a number of bugs in the Adobe Acrobat Plug-In for browsers, and in the free Adobe Reader 6 and 7. A malicious website may be able to caryy out cross-site scripting attacks because the browser plug-in doesn't correctly validate URI parameters. There's no official word from Adobe, although US CERT says that it appears the bugs were fixed in Adobe Reader 8. Read their report at http://www.kb.cert.org/vuls/id/815960. Stefano Di Paola, Giorgio Fedon, and Elia Florio are credited with finding these bugs.
The Month of Apple Bugs has found a bug in the way that Apple iPhoto handles photocast XML feeds. A malicious user could construct an XML feed in such a way that it could run hostile code on the victim's computer. The bug is in iPhoto 6.0.5. It may also be in earlier versions of iPhoto that use photostreams. Read more at http://projects.info-pull.com/moab/MOAB-04-01-2007.html.
According to Apple, when syncing any iPod to a Mac running iTunes 7.0x or later, you may see this error message:
Attempting to copy to the disk "Customer's iPod" failed. An unknown error occurred (-48).
According to Apple, you can work around this error by temporarily setting the time zone on the Mac to Pacific Standard Time. (I guess the computer is homesick for Cupertino.) Then restore the iPod, and move back to the correct time zone. See the details at http://docs.info.apple.com/article.html?artnum=304893.
Even if you shell out the extra money to buy the Windows Vista Home Premium Edition, you won't be able to get that computer to join a domain. Domains, I guess, are for the corporate world, and Microsoft says this version is for the "home". That means they left out some of the networking stuff.
Microsoft says if you are setting up for unattended installation of Windows Vista, it's possible that Vista may get installed in the wrong partition of your hard drive. Microsoft says that's because Unattend.xml file does not assign a drive letter to the installation partition. Read more about what you need to do at http://support.microsoft.com/kb/929848.
Microsoft has a Windows Easy Transfer tool that will let you move files and settings from one Windows Vista computer to another. However, if you are going from a 32-bit Vista computer to a 64-bit Vista computer, some settings will get left out. See the details at http://support.microsoft.com/kb/929459.
OpenOffice always strives for compatibility with Microsoft Office. In this case, however, they may have gone too far. OpenOffice.Org announced that the open-source office suite also has a bug in the way it handles WMF (Windows MetaFile) graphics. Microsoft Office has had some much-publicized problesm with WMF graphics themselves over the past year. The bug is fixed in OpenOffice 2.1, which is available at http://www.openoffice.org/.
1/5/2007 Opera Bugs in JPEG and SVG
Two bugs have been discovered in Opera Software's Opera 9 web browser, that may allow attackers to sneak hostile code onto a computer. One bug is in the way Opera handles DHT markers in JPEG files. The other is in the matrices are handled in JavaScript and SVG. These bugs have been fixed in Opera 9.10, which you can get at http://www.opera.com/download/. Opera credits iDefense Labs for finding these bugs.
1/4/2007 Adobe Reader and Plug-in Bugs
There are a number of bugs in the Adobe Acrobat Plug-In for browsers, and in the free Adobe Reader 6 and 7. A malicious website may be able to caryy out cross-site scripting attacks because the browser plug-in doesn't correctly validate URI parameters. There's no official word from Adobe, although US CERT says that it appears the bugs were fixed in Adobe Reader 8. Read their report at http://www.kb.cert.org/vuls/id/815960. Stefano Di Paola, Giorgio Fedon, and Elia Florio are credited with finding these bugs.
1/3/2007 Google Patches Gmail Hole
It appears that Google has fixed a bug in Gmail that would allow a cross-site scripting attack. If a user logged on to Gmail, using their browser, and then later visited a malicious website (without logging out of Gmail), the attackers may have been able to steal all the email addresses from the Contacts list. There have been conflicting reports on how rapidly, and how completely, Google fixed this bug. Network World has the report as of 1/2/07 at http://www.networkworld.com/news/2007/010207-google-closes-gmail-cross-site-scripting.html.
Adobe says you may have problems using Adobe Premiere Elements to capture video from devices that use WDM, the Windows Driver Model. WDM is supposed to give you plug-and-play support for camcorders and USB webcams. If you are having problems, see http://www.adobe.com/support/techdocs/333148.html. Adobe gives a list of WDM devices that should be compatible, and they also have a set of troubleshooting steps.
When installing either iTunes 7.0 or QuickTime 7.1.3 for Windows, the installation process may quit with this error message: The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2738. According to Apple, this may be an incompatibility with the Visual Basic Script inside the Windows Installer for iTunes. Apple says you may have to register VBScript with Windows. See how to do that at http://docs.info.apple.com/article.html?artnum=304405.
Cisco says that their Cisco Clean Access software has a bug. The software relies on an unchangeable shared secret between the Clean Access Manager (CAM) and Cisco Clean Access Server (CAS) devices. Unfortunately, this shared secret is guessable via a brute-force attack, which could allow attackers to gain administrative access. See the fix information at http://www.cisco.com/en/US/products/products_security_advisory09186a00807b6621.shtml.
When you attach a video camera, with the power turned on, to a Windows Vista computer via Firewire or USB, the Autoplay window may not turn on. Microsoft says you should be able to manually start Windows Movie Maker and then capture the video. (While they don't say so, you should also be able to use third-party video software manually.) See http://support.microsoft.com/kb/930059 for more.
If you are trying to use a third-party program to send a file via email using Microsoft Outlook 2007, you may have problems when you give the File, Send command in the other program. You may see an error message similar to: Program_Name could not send the document because of MAPI failure: "Unspecified error" Send Mail failed to send the message. The problem may happen if Outlook 2007 is already running with Administrator rights, and the third-party program isn't. If that's the case, take the somewhat counter-intuitive step of close Outlook 2007, and then try to send the file again. See http://support.microsoft.com/kb/929362 for more.
1/2/2007 Quicktime Bug Allows Buffer Overflow
There is a bug in the way that Apple Quicktime handles RTSP (Real time streaming protocol) links. It may be possible for an attacker to construct one of these links that would trigger a buffer overflow which could be used to run hostile code on your computer. According to the Secunia website at http://secunia.com/advisories/23540/, the bug has been verified in Quicktime 7.1.3.100 for Windows. It is also supposed to affect other Windows and Mac versions as well. Secunia credits LMH for finding the bug.
Start up Adobe Acrobat 8 Standard or Professional, and you may see this ominous error message:
A serious error has been detected and Adobe Acrobat 8 Professional cannot continue. Please reinstall the application and try again.
Adobe has three possible fixes for this -- one is to remove and then reinstall Acrobat. The other two involve fixing your AdobeConfig file. See the details at http://www.adobe.com/support/techdocs/327986.html.
Apple has a new iPod shuffle Reset Utility. The new version 1.0.1 is only for First Generation 512MB and 1GB iPod shuffles. It is not for newer shuffles or for regular iPods. It will fix a number of different problems with you shuffle. See the list at http://www.apple.com/support/downloads/ipodshuffleresetutility101formac.html.
This is bad news if you are a media company trying to use digital rights management on new high-definition DVD disks. A story at C Net says that some hackers have claimed to crack the new copy-protection system called AACS, or Advanced Access Content System. Read more at http://news.com.com/Companies+probe+possible+high-def+DVD+hack/2100-1029_3-6146267.html.
Just before Christmas, Federal Computer Week reported that the Department of Defense will be screening out all HTML-based email messages. They are doing this to protect against more email-based security threats. They also ruled out using Microsoft Outlook Web Access email applications. If you are sending email to the Pentagon, makes sure its text-based. Read the whole thing at http://www.fcw.com/article97178-12-22-06-Web.
Anyone still using IBM Lotus SmartSuite 9.8 and the Lotus Approach database may want to get fix pack 4. (also known as SmartSuite 9.8.4.) If fixes a number of bugs that caused Apprach to crash when doing searches on Windows XP, or crashes during search and replace operations. See the details at http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg21180536.
PCI ExpressCard devices may have compatibility problems with laptop computers running Windows Vista. Check the Device Manager, and you may see the yellow exclamation mark warning next to it. The problem occurs if the Advanced Configuration and Power Interface (ACPI) BIOS has resource rebalancing turned on. Microsoft has a hotfix for this, which should be in a future Windows Vista service pack. If you need the fix right away, see http://support.microsoft.com/kb/929550.
If the time and date are not approximately correct on a Windows Vista computer, you will not be able to search for new Vista updates. Instead, Microsoft says you may see this error message: Windows could not search for new updates (Code 80072F8F). You will need to set the date and time correctly, since the security used during the update (Secure Socket Layers, or SSL) is based on it. See http://support.microsoft.com/kb/929458 to find out how to do this.
Make sure you have a printer configured for your computer when you use the Microsoft Excel 2007 Optimizer feature in the Project Portfolio Server 2007. If you don't, you will see this error message: Unable to set the Orientation property of the PageSetup class. Microsoft says you can use the Add Printer Wizard to do this. See how at http://support.microsoft.com/kb/929586.
There has been another patch for EVGA nForce 680i SLI motherboards that use Serial ATA disk drives. NVIDIA, which supplies the chipset, and EVGA are responding to complaints of blue screens of death and corrupted boot drives. Read more at http://www.xbitlabs.com/news/chipsets/display/20061222124554.html.
There is a bug in the WordPress 2.0.5 blogging software that may allow an attacker to conduct a script insertion attack. WordPress has a fix for this at http://trac.wordpress.org/changeset/4665. The bug was discovered by David Kierznowski.
1/1/2007 MS Word Wins the Bug of the Month
Three unpatched zero-day bugs gives Microsoft Word the coveted award.
12/31/2006 Redesign on the Fly
We are going to start 2007 with a redesign of the BugBlog website as well as bjkresearch.com. From a design standpoint, it is only a subtle redesign, but in terms of the HTML behind the scenes, there are quite a few changes - dropping the old JavaScript powered rollover navigation buttons for CSS-based navigation controls, and using CSS layout and positioning instead of the old table-based design. Because I'm overlaying the new pages and graphics on top of the old, there's certainly a chance that something will get mangled. If you find a bug in the BugBlog, please let me know. All the old pages won't be converted -- but everything else going forward should be XHTML compliant.
12/30/2006 Reports of Some Gmail Problems
Techcrunch reports on an issue where a number of people, who all appear to be Mozilla Firefox 2.0 users, reported a mass deletion of their Gmail emails, while they were logged in. Read more at http://www.techcrunch.com/2006/12/28/gmail-disaster-reports-of-mass-email-deletions/, including a link to a discussion of the problem at Google Groups, and a response from Google -- which indicates this affected around 60 people. Just goes to show that you should back up your Gmail, err... never mind.
12/29/2006 Novell Pops a New SUSE Linux Kernel
There is a new Linux 2.6 kernel for Novell SUSE Linux Enterprise Server 9 and SUSE Linux Enterprise 10. It fixes a bug in the UDF filesystem that sometimes caused the computer to hang when it was truncating files. It also plugged a struct file leak in the perfmon(2) system that happened when the OS was running on an Itanium-based system. Find out more at http://www.novell.com/linux/security/advisories/2006_79_kernel.html
12/28/2006 Acrobat Viewer for the Mac Only Likes Safari
If you want to view Adobe Acrobat PDF files within the Apple Safari web browser, you must be using Mac OS X 10.4.3 or later. Adobe says that the Adobe PDFViewer for Mac OS X won't work on older versions. Also, it will only work within Safari; it doesn't work with Firefox or Opera running on a Mac. See http://www.adobe.com/support/techdocs/333545.html for configuration information.
If you try to install the EA Battlefield 2142 1.10 patch, you may get an error message that says you already have a newer version installed. That may happen if you had tried out the Beta version of the patch. Unfortunately, you will need to go through a complicated Registry edit to fix this. See
http://support.ea.com/cgi-bin/ea.cfg/php/enduser/std_adp.php?p_sid=W1dUMgqi&p_faqid=14319 for the details.
If you look at the Add-in Manager for Microsoft Access 2007, you may see an add-in listed as #401. Microsoft says this is actually the Access Replication Wizard COM add-in, and from an earlier version of Access. This wizard is Acecnf.dll, the 2007 Office database engine Conflict Resolver. To help sort your way out of DLL hell, see http://support.microsoft.com/kb/928024.
If a DVD does not have a First Play Program Chain (PGC) file, it may not play successfully in the Windows Media Center on Windows Vista. Instead, all you will see is a black screen. Microsoft says Windows Media Center Edition 2005 can only play DVDs with that file. Luckily, almost all professionally-made DVDs will have that file. Unluckily, some consumer-manufactured DVDs won't. In that case, use a third-party DVD player.
Secunia says that there is a bug in the CSRSS.exe component of Windows 2000 Server (all versions), and Windows XP that local users can exploit to see the contents of view the contents of CSRSS process memory. If those users are both malicious and skilled, they can use that knowledge to further attack these servers. Secunia credits Rubén Santamarta with finding this bug.
Red Hat has updated tar packages for Red Hat Enterprise Linux 2,3, and 4, and for the Red Hat Desktop. There is a path traversal bug in the way GNU tar archives are extracted. An attacker may be able to use this bug to write over arbitrary files. Red Had credits Teemu Salmela with finding this bug. Get the update at https://rhn.redhat.com/errata/RHSA-2006-0749.html.
12/27/2006 Media Center Update Causes DRM Bug
Once you have installed Windows XP Media Center Edition 2005 Update Rollup 2, you may have problems with Windows Media Digital Rights Manager files. Try to play back one of the protected files, and you may get an error message similar to one of these:
Restricted Content: Restrictions set by the broadcaster and/or originator of the content prohibit playback of the program on this computer
or
0xC00D2751: A problem has occurred in the Digital Rights Management component. Contact Microsoft product support.
Microsoft has issued a new fix to take care of the bug introduced by Update Rollup 2. Get the latest fix at http://support.microsoft.com/kb/913800/. Watch here to find out what bugs this latest bug fix introduced.
If you use Microsoft Outlook 2000 on a Windows 2000 computer, and then you install Adobe Acrobat 7, you may end up with an extra menu item for Convert to Adobe PDF every time you load the PDFMaker DLL. Adobe says you will need to upgrade to Acrobat 8 for a fix. See http://www.adobe.com/support/techdocs/331832.html for more.
If you are importing a calendar into Apple iCal 1.5.4, you may get a warning about unsafe alarms. If a calendar event is set to start another application or open a document, iCal considers it unsafe. Find out more about unsafe alarms at http://docs.info.apple.com/article.html?artnum=300368.
If you are using Apple DVD Studio Pro 4.1 or Final Cut Studio 5.1 on a Mac Pro, and you want to to format a DLT drive so that you can copy a project to it, the process may start OK. You will see a progress bar that will say "Writing lead in data" but you will get no other progress. Eventually, you will need to cancel the process. At this point, Apple has no workaround other than to suggest using a recordable DVD or external hard drive rather than a DLT drive.
It's Year in Review time, and Symantec takes a look at the Year in Review in Phishing. They look at the increase in phishing, new attack vectors and new techniques. Read the whole thing at http://www.symantec.com/enterprise/security_response/weblog/2006/12/phishing_2006_the_year_in_revi.html.
If you are having trouble connecting to websites in Southeast Asia, or in emails to that area, an earthquake off the coast of Taiwan disrupted a number of submarine cables that carry Internet traffic. Not only will it affect Taiwan, it is also causing problems for the Philippines, Hong Kong, and Singapore.
If you use the Top Ten items or Bottom Ten items to group data in a Microsoft Excel 2007 pivot table, you may not be able to ungroup your group. Instead, Excel will crash with this error message: Excel cannot complete this task with available resources. Choose less data or close other applications. At this time, Microsoft's only fix suggestion is not to use those options. See http://support.microsoft.com/kb/928982 for more.
If you use the Windows Vista Disk Cleanup tool, Microsoft says you may break the Hibernate option within Power Options, or the sleep feature may lose it settings if power is lost. If you find that hibernation got broken, Microsoft says you can use the powercfg -h command instead. See http://support.microsoft.com/kb/928897 for the details.
If you run into application compatibility issues in Windows Vista, Microsoft has compiled a set of troubleshooting steps, plus links to other information, at http://support.microsoft.com/kb/927386.
If you upgrade from Windows XP to Windows Vista, and still use a dial-up modem, you may no longer hear the audio handshake, (also known as that annoying squeal) when a dial-up connection is made. Microsoft says that is because some modem drivers don't know how to stream their audio to Vista. However, the connection will still get made. If you want to hear it, you may need a modem driver upgrade.
There is a bug in Novell Netmail 3.52 that may allow authenticated attackers to crash a mail server and trigger a denial of service attack. It has been fixed at 3.52e FTF2 of NetMail. Get the Windows version at http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974928.htm.
12/22/2006 Threat Against Windows, Including Vista
The Microsoft Security Response Center may have had a slight delay in the beginning of their Christmas holiday, with reports of a public exploit against the Client Server Run-Time Subsystem in Windows 2000 SP4, Windows Server 2003 SP1, Windows XP SP1, Windows XP SP2 and Windows Vista operating systems. According to their blog, the attacker must have authenticated access to a computer system in order to carry out the attack, which makes it potentially less damaging. More interesting, however, is that Vista is included on the list of vulnerable systems. Read the whole thing at http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx.
If you are using Adobe Acrobat 8 on an Intel-based Mac OS X computer, you may not be able to use the Create PDF from Scanner option. Even though the scanner may be attached to your computer, there won't be any scanner listed in the drop-down menu. Adobe says you will either have to find a Universal Binary driver for the scanner, or use the image capturing software that came with your computer.
If you play Lionhead Studios Black & White 2 on a Windows XP computer with an ATI Radeon graphics card, you may get a rather slow frame rate when setting graphics to their lowest settings. This has been fixed by ATI in their Catalyst Software Suite 6.12.
McAfee Avert Labs talks about more threats from password stealing malware, including a new one that works over Skype named PWS-JO. While it is not surprising that financial institutions are the number one target for password stealers, the second biggest target is Massive Multi-Player Online Role Playing Games (MMORPG). Read the whole thing at http://www.avertlabs.com/research/blog/?p=157.
If you receive a digitally signed email message in Microsoft Outlook 2007, and that message was sent through a mail server that was not Microsoft Exchange, the message may have a paperclip icon, which denotes a message attachment. The icon will be there even though there isn't an attachment. Microsoft does not have a fix or workaround.
There is a bug in the way that password-protected Microsoft Excel 2003 workbooks saved to a Microsoft Windows SharePoint Services document library are protected. While a password that allows modification will work as expected, when you save changes, the password then becomes lost. Microsoft has a hotfix for this, which will be in a future Office 2003 service pack. If you need the fix right away, you will need to contact Microsoft Technical Support. See how at http://support.microsoft.com/kb/929086.
On a Windows Vista computer, if you have configured your screen saver to display the logon screen box, and also have set Require a Password on wakeup, then if you try to watch a video in the Windows Media Center in full-screen mode, the screen saver may turn on. As a workaround, Microsoft says you will need to reverse one of those two conditions. See the details at http://support.microsoft.com/kb/929526.
Microsoft is finally sharing the programming interface, or APIs, for Windows Vista with third-party security firms. It appears that the firms are happy now, but it will probably take awhile for them to have software that works with Vista. Read the article (and possibly between the lines) at http://news.zdnet.com/2100-1009_22-6145285.html.
There is a bug in Mozilla Firefox 1.5.0.8 and 2.0, Thunderbird 1.5.0.8, and SeaMonkey 1.0.6 that may allow JavaScript to use the src attribute of an image element that is in a frame to launch a cross-site script injection. This could be used to steal log-in information by impersonating another website. This has been fixed in Firefox 2.0.0.1 and 1.5.0.9, Thunderbird 1.5.0.9, and SeaMonkey 1.0.7. Mozilla credits moz_bug_r_a4 for finding this bug.
The Feed Preview feature in Mozilla Firefox 2 inadvertantly sends some of you feed-browsing behavior to other websites, which is something of a privacy invasion. This has been fixed in Firefox 2.0.0.1. Mozilla credits Jared Breland for finding this bug.
There is a bug in the way that Mozilla Firefox 2.0 and 1.5.0.8, Thunderbird 1.5.0.8, and SeaMonkey 1.0.6 uses LiveConnet to create a bridge between Java applets and JavaScript on a website. The bug may cause a crash, and it may be possible to exploit this to corrupt memory and run hostile code on your computer. This has been fixed in Firefox 2.0.0.1 and 1.5.0.9, and SeaMonkey 1.0.7. Mozilla credits Steven Michaud for finding this bug.
12/21/2006 What Does Microsoft Have to Fix?
The Internet Storm Center has posted a very useful chart. It shows their count of Microsoft's zero-day bugs. (Where exploits are known, but there isn't a fix yet.) As of 12/21, there are three critical bugs (all for MS Word), four that are marked less urgent, and three bugs where they don't know enough details to label their severity yet. See the whole list at http://isc.sans.org/diary.php?storyid=1940.
12/20/2006 Cursor Bug Trips Up Mozilla
There is a bug in the way that Mozilla Firefox 2.0 and 1.5.0.8, Thunderbird 1.5.0.8, and SeaMonkey 1.0.6 set the CSS (Cascading Style Sheet) cursor property. The bug may cause a buffer overflow as the custom cursor is converted to a Windows bitmap. This can possibly be exploited by a malicious website to install hostile code on your computer. This has been fixed in Firefox 2.0.0.1 and 1.5.0.9, Thunderbird 1.5.0.9, and SeaMonkey 1.0.7. Mozilla rates this as a Critical bug, and credits Frederik Reiss with finding and reporting it.
In Adobe Premiere Elements 3.0, if you create a Favorite from a video effect or transition, it may cause this error message when you try to do an edit or load a project:
Adobe Premiere Elements has encountered an error. \pre\Libraries\UIFramework\Src\Window.cpp-267.
Adobe says there are two things you can do to fix this. Either get rid of all the effects and transition Favorites, or delete the Effect Presets and Custom Items preference file. See http://www.adobe.com/support/techdocs/333498.html for the details.
Apple has found a bug in QuickTime for Java, and in the Quartz Composer for Mac OS X 10.4.8. A malicious website may be able to take advantage of this bug to capture images from your computer, and that these images may have local information. This has been fixed in the Apple Security Update 2006-008. The bug doesn't affect QuickTime for Windows, nor does it affect Mac OS X 10.3 or earlier.
If you are trying to play EA Battlefield 2 on a Windows XP computer with an ATI graphics card set to 1920x1440 or 2048x1536 resolution and AA set to 6 times, you may not be able to get the game to start. This has been fixed by ATI in their Catalyst Software Suite 6.12 update.
On a Windows XP computer with an ATI graphics card and the Catalyst Software Suite 6.11 or earlier, playing a DVD with PowerDVD may give a choppy playback. This has been fixed in the Catalyst Software Suite 6.12.
McAfee's SiteAdvisor has published a study looking at how safe search engines are. They judge safety as to how likely it is that the search results will send you to a malware site. The search engines themselves have ratings very close together -- barely more than one percent separates the best from the worst. One surprising fact, as pointed out by BugBlog reader Roseman, is that these are the keywords that take you to the riskiest sites: bearshare, free screensavers, and free ringtones. Read the whole thing at http://www.siteadvisor.com/studies/search_safety_dec2006.
Microsoft has re-released Security Bulletin MS06-078, which fixes critical bugs in the Windows Media Runtime Format 7.1 and 9.0. However, you only have to worry about it if you are Korean and installing the Korean-only package. Those users were getting this error message at installation:
Setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer. 0x8007F0DA.
The re-release is at http://support.microsoft.com/kb/923689.
In Microsoft PowerPoint 2007, you can create a chart, add shapes to the chart, and type URLs into the shapes. However, if you use a shortcut version of the URL, such as www.bugblog.com, when you re-open the presentation the shapes and URL won't be there. Microsoft's workaround is to type the complete URL, such as http://www.bugblog.com, into the chart.
There is a bug in Mozilla Firefox 1.5.0.8 and 2.0, Thunderbird 1.5.0.8, and SeaMonkey 1.0.6 that may cause a security problem if a plugin reduces the floating point precision of the CPU. Mozilla points out that this sometimes happens with plugins that create Direct3D devices. It will lead to a bug that overwrites memory, which can be exploited by malicious websites. This has been fixed in Firefox 2.0.0.1 and 1.5.0.9, Thunderbird 1.5.0.9, and SeaMonkey 1.0.7. They credit Keith Victor with finding this bug.
There is a bug in the way that Mozilla Firefox 2.0 and 1.5.0.8, Thunderbird 1.5.0.8, and SeaMonkey 1.0.6 implements the JavaScript watch() function. A website may be able to exploit this to download malware to your computer. It will only affect Thunderbird if JavaScript is activated for email, which is not the default configuration nor is it recommended. This has been fixed in Firefox 2.0.0.1 and 1.5.0.9, Thunderbird 1.5.0.9, and SeaMonkey 1.0.7.
In Mozilla Firefox 1.5.0.4 and later versions, a crash with memory corruption can occur if SVG comments are appended from one document into an HTML document. The memory corruption can be exploited to download malware onto your computer. This has been fixed in Firefox 2.0.0.1 and 1.5.0.9, and SeaMonkey 1.0.7. Mozilla credits TippingPoint and the Zero Day Initiative for passing along an anonymous tip about this bug.
12/19/2006 Apple Says to Avoid This Folder
Apple has hired some creative writers for their Knowledge Base. They say "As if it were a swarm of bees, you should stay away from the SyncServices folder" for Mac OS X 10.4. If you don't heed their advice you could end up with duplicate data in your address book or iCal. Even worse, you may lose some data. If you don't know where that folder is (and remember that you shouldn't go there), it's in Home folder, Library, Application Support. Appreciate their entire literary effort at http://docs.info.apple.com/article.html?artnum=301920.
While using Adobe InDesign or Illustrator CS2, you may have problems printing to a Hewlitt Packard 4M printer. Try to print, and you may see this rather intimidating error message:
ERROR: typecheck OFFENDING COMMAND: known STACK: �/@shouldNotDisappearDictValue true /CTHasResourceForAllBug false false.
Adobe gives a way to avoid the problem -- they say that within InDesign or Illustrator, save your file as a PDF. Then do your printing from Adobe Acrobat instead.
A late 2006 model iMac running Mac OS X 10.4.7 or later may ignore the configuration setting that tells the screen saver never to activate. Apple says that the screen saver decides to start anyway, after the computer goes through an idle period. Luckily, a key press or mouse wiggle will turn it off. Keep an eye on http://docs.info.apple.com/article.html?artnum=304394 for any announcement of a permanent fix from Apple.
Gizmodo has some pictures of an Apple Macbook Pro whose batteries started to inflate like a balloon. Readers give some of their own laptop horror stories in the comments to the story at http://www.gizmodo.com/gadgets/laptops/macbook-pro-batteries-are-inflating-222468.php.
PC World says that some of the fancy new graphics features in Windows Vista may cause laptop computers to work so hard that you will see much shorter battery life. The "Aero" windows in Windows cause the processors and graphics cards to work much harder, which drains the batteries. Shutting off the new graphics features may help. Read the whole thing at http://www.pcworld.com/article/id,128252-pg,1/article.html.
The Microsoft Office 2003 update of 12/12/06 rolls up a number of earlier hotfixes for the German version of Office. See the complete list of hot-fixes includes, which stretch between December 2005 and November 2006, at http://support.microsoft.com/kb/924886.
Some security researchers are reporting that a computer worm may be circulating via Skype's chat feature. If you are using Skype, ignore any message that asks you to download a file called sp.exe. At this point, Websense thinks it’s a worm, F-Secure doesn't think so, and the Internet Security Center is still studying the issue. Read the whole thing at http://www.pcworld.com/article/id,128258-c,trojanhorses/article.html.
12/18/2006 Anti-phishing Speedup for IE 7
The anti-phishing shield in Microsoft Internet Explorer 7 may cause the browser to bog down and run slowly if you visit a web page that has lots of frames, or if you browse through many different frames over a short period of time. Microsoft has a fix for this. IE 7 users can get it at http://support.microsoft.com/kb/928089.
There's a chance that you will have compatibility problems with an Apple AirPort if you have a 15or 17 inch Core 2 Duo MacBook Pro, or a 13 inch Core 2 Duo Macbook. If so, get the AirPort Update 2006-002 at http://www.apple.com/support/downloads/airportupdate2006002.html. Its supposed to be a compatibility fix.
Versions of Apple WebObjects earlier than 5.3.1 may have compatibility problems with J2SE 5.0 Release 4. Upgrading to WebObjects 5.3.1, available at http://docs.info.apple.com/article.html?artnum=302797, should fix that, as well as some problems in EOEditing.
If you try to play Rebellion Software's Snipter Elite on a Windows XP computer with an ATI Radeon X1600 graphics card, you may see corruption in some of the screen textures. This has been fixed in the ATI Catalyst Software 6.12 update.
If you mark a Microsoft Access 2007 database file as read-only, then you will not be able to get rid of the Search text box in the Navigation pane. Microsoft says that even if you uncheck the Show Search Bar option, it will be there. They say this is by design, so if you don't want the Search bar, you must get rid of the read-only attribute.
The Lsass.exe process on a Windows Server 2003 computer may have a memory leak when using a DCOM program that is both on the client side and on the server side. The leak happens in the way the security package is negotiated. Microsoft has a hotfix for this, which will be in a future Windows Server 2003 Service Pack. If you can't wait, see http://support.microsoft.com/kb/902058 for information on how to get the fix right away.
12/15/2006 Yahoo Messenger Tripped Up By ActiveX Bug
Yahoo (I'm not putting in the exclamation point) says there is a bug in their Yahoo Messenger due to a bad ActiveX control. The bug may trigger a buffer overflow, which could be activated by visiting a maliciously designed web page. Yahoo says you may be vulnerable if you installed Yahoo Messenger before 11/2/06 (although they didn't post this notice until 12/8/06). You can get an update that fixes this bug at http://messenger.yahoo.com/security_update.php?id=120806.
Any custom PDF settings that you create in Adobe Acrobat 8 Distiller will not be automatically available in Adobe Creative Suite 2.0 applications. That's because they get saved to a different location than the where the Creative Suite applications look. Adobe has some workarounds so that the applications know where to look. See them at http://www.adobe.com/support/techdocs/333516.html.
According to Google, some Mozilla Firefox users are having problems adding Contacts while using Gmail. Google says this happens if you are using the Tabbrowser extension in Firefox. Getting the latest version of this extension may fix the problem. If not, see other workarounds from Google at http://mail.google.com/support/bin/answer.py?answer=10282&topic=1525.
A third zero-day bug has been discovered in Microsoft Word 2000, XP, and 2003. Microsoft itself hasn't 'fessed up on this one (they are probably working on fixes for the first two) but McAfee talks about it, calling it the Microsoft Word 0-Day Vulnerability III, at http://vil.nai.com/vil/content/v_vul27264.htm. A zero-day bug means that code to exploit it is already circulating.
Make some display adjustments in Microsoft Excel 2007, and after you give the CTRL+F11 command to add a macro worksheet, all your other worksheet tabs will disappear. The display adjustments that trigger this include turning off the horizontal scroll bar, turning off the vertical scrollbar, and sheet tabs. Microsoft has some workarounds for this. See the details at http://support.microsoft.com/kb/928989.
Those of you who use PHP a lot may want to read this eWeek Security Watch story. Stefan Esser has resigned from the PHP Security Response Team "in disgust", apparently unhappy with a cavalier attitude towards fixing security bugs. Read the whole story at http://securitywatch.eweek.com/open_source/php_security_guru_quits_in_disgust.html.
12/14/2006 Vista Changes Unpacking Method
Microsoft has changed the way that the Microsoft Update Standalone packages work for Windows Vista. The old way to view the contents or extract the contents of one of the packages will not work -- especially if you are trying to do this on a non-Vista computer. It's because they use the "New and Improved" (those are air-quotes) Intra-Package Delta (IPD) compression technology. You will need to get the Windows Vista OEM Pre-installation Kit (OPK) if you want to view and extract. See http://support.microsoft.com/kb/928636 for the details.
12/13/2006 An Accidental Patch from Microsoft
A security patch for Microsoft Office for the Mac was accidently released ahead of time via auto-update. According to the Microsoft Security Response Center blog, they are still testing this patch, and a pre-release version was accidently released. They've taken the patch out of circulation, and they also recommend that you uninstall the patch. See http://blogs.technet.com/msrc/archive/2006/12/13/information-on-accidental-posting-of-pre-release-security-updates-for-office-for-mac.aspx for the details.
If you installed IBM Lotus Notes in single user mode, and then some other user installed Adobe Acrobat 8 on the computer, you won't have a PDMaker option from within Notes. Adobe has some workarounds for this at http://www.adobe.com/support/techdocs/333476.html.
If you are restoring an iPod using Apple iTunes 7 or 7.0.1, you may see this error message: An unknown error has occurred with one of these numbers included in the message: 1415, 1417, 1418, or 1428. What Apple really means in that message is that you need to upgrade to iTunes 7.0.2 or later.
Try to play an MP3 file that’s been ecoded at 32Khz or higher with a mono channel on a Fifth Generation iPod, and Apple says the iPod may reset itself. You will need to upgrade the iPod software to 1.2.1 or later. Do this via iTunes.
After you upgrade a computer to Windows Vista, some of the uninstall information for programs that are loaded on that computer may be incompatible with the Vista uninstall process. You won't be able to use Vista's uninstall process in the Programs and Features control panel. Microsoft has five possible workarounds that will let you delete the programs. See the details at http://support.microsoft.com/kb/927395.
The validation process for Windows Vista will become one of the more controversial features for the new OS. Microsoft has just released an update for the Windows Vista validation component on Windows Update. They don't specify why it needed updated only a couple weeks after the program was released to manufacturing.
Note that Microsoft's Patch Tuesday releases for December did not include fixes for the two zero-day exploits against Microsoft Word. NASA is not waiting -- they are blocking all Microsoft Word email attachments until patches are released. Read the whole story at http://www.msnbc.msn.com/id/16095705/.
If you install the 913800 Update for Microsoft Windows XP Media Center Edition 2005, then you may not be able to successfully complete the update to Windows Media Player 10 via automatic update. Instead, you will see this error message: A more recent version of Windows Media Player is already installed. To fix the problem caused by the earlier update, Microsoft says to install the 92651 critical update, either via the Microsoft Update web site or Windows Update. See http://support.microsoft.com/kb/926251 for details.
The Sophos Anti-Virus scanning engine has a bug in the way it handles CPIO files. A maliciously designed filename could trigger a buffer overflow. An attacker could take advantage of this to run their own code on a victim's computer. This has been fixed in the Sophos Anti-Virus engine 2.40. See http://www.sophos.com/support/knowledgebase/article/17340.html for the details. Sophos credits an anonymous tipster working through TippingPoint and the Zero Day Initiative for finding this bug.
Sun Microsystems says that a bug in Solaris 8,9, and 10 may let local unprivileged users run their own code with elevated privileges. Sun has fix information at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102724-1. They credit iDefense with finding these bugs. If you want the inside scoop on the bugs, see http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=449 and http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=450
Symantec has had to patch a number of bugs in their NetBackup Enterprise Server/NetBackup Server, Server and client and Storage Migrator for Unix option 5.0, 5.1, 6.0. A remote attacker, with access to the Netbackup servers, may be able to run their own code on the vulnerable servers. Symantec has links to patches at http://www.symantec.com/avcenter/security/Content/2006.12.13a.html.
12/12/2006 Windows Media Format Bugs Allow System Takeover
There are two critical bugs in Windows Media Format files that can affect almost all current versions of Microsoft Windows. One bug is in the way that Windows handles Advanced Systems Format (ASF) files, and the other is in Advanced Stream Redirector (ASX) files. Run into one of the maliciously-designed files at a website or in email, and the attacker may be able to take control of your system. It affects Windows 2000, Windows XP, and Windows Server 2003, but not Windows Vista. It affects all versions of Microsoft Windows Media Format 7.1 through 9.5 Series Runtime, but version 11 is not affected. Microsoft has patches available at http://www.microsoft.com/technet/security/Bulletin/MS06-078.mspx.
One of the critical security bulletins that Microsoft published on the December 2006 Patch Tuesday is a Cumulative Security Update for Microsoft Internet Explorer. You will be relieved to know that this is an update for the old IE, IE 5.01 and 6. The brand new Internet Explorer 7 does not need a security update yet. (or at least, they haven't released one.) This update fixes four bugs, two in script handling and two in TIFF handling, that may allow an attacker to take control of your computer. Get the update at http://www.microsoft.com/technet/security/Bulletin/MS06-072.mspx. Microsoft credits Jakob Balle and Carsten Eiram of Secunia Research, Sam Thomas, working with TippingPoint and the Zero Day Initiative, and Yorick Koster of ITsec Security Services for finding these bugs.
There is a bug in the wmiscriptutils.dll file of Microsoft Visual Studio 2005, the WMI Object Broker control. An attacker may be able to construct a web page that, if viewed by a user of Visual Studio 2005, could allow for the complete take-over of the computer. This ActiveX control is not automatically in the default allow list for Internet Explorer 7, so those users are safe unless they've activated permission. Microsoft has a fix for this at http://www.microsoft.com/technet/security/bulletin/ms06-073.mspx. They credit TippingPoint and the Zero Day Initiative for finding this bug.
Microsoft has released a Cumulative Security Update for Outlook Express on Windows 2000, Windows XP, and Windows Server 2003. There is a bug in the way that the Windows Address Book is handled that can be exploited by an attacker. A Windows Address Book file would have to be sent to initate the attack, and the victim would have to open the file. Microsoft labels this an Important update. Get the fix at http://www.microsoft.com/technet/security/Bulletin/MS06-076.mspx.
There is a bug in the SNMP Service (Simple Network Management Protocol) of Windows 2000, Windows XP, and Windows Server 2003 that may allow a remote attacker to take complete control of a system. Since the SNMP Service is not enabled by default, Microsoft only rates this an Important update. Of course, it's a lot more important if you use SNMP. See the details and fix at http://www.microsoft.com/technet/security/bulletin/ms06-074.mspx. Microsoft credits Kostya Kortchinsky of Immunity, Inc. and Clement Seguy of the European Aeronautic Defence and Space Company for finding this bug.
There is a bug in the way that Microsoft Windows XP Service Pack 2 and Windows Server 2003 handles the file manifests when applications are started. This may allow a local user with valid login credentials to gain elevated privileges. Microsoft rates this as an important update. Get it at http://www.microsoft.com/technet/security/bulletin/ms06-075.mspx.
There is a bug in the Remote Installation Service of Microsoft Windows 2000 Service Pack 3 that may allow anonymous users to overwrite an existing operating system file, if that file has been installed by a RIS server. This capability is not turned on by default in Windows 2000. Microsoft has a fix for this at http://www.microsoft.com/technet/security/bulletin/ms06-077.mspx. Microsoft credits Nicolas Ruff for finding this file.
12/11/2006 Another Microsoft Word Bug Allows Attack
There is a new zero-day attack against Microsoft Word, apparently unrelated to the zero-day attack discussed in the 12.6 BugBlog. It affects Word 2000, 2002, 2003, and the Word Viewer 2003. However, the brand new Word 2007 is not affected. (A cynical person would say this is all a marketing ploy to get people to upgrade. Luckily, I'm not cynical.) The issue is being actively exploited, according to Microsoft. At this point, it does not appear that there will be a fix for either of these issues in time for the 12/12 Patch Tuesday Security Releases. See http://blogs.technet.com/msrc/archive/2006/12/10/new-report-of-a-word-zero-day.aspx for more.
Adobe says that if you want to create video in Premiere Elements to export to a Sony PlayStation Portable (PSP), you will be limited to only one MPEG-4 standard, H.264 (AVC). While the PSP supports another standard, MP4 - Simple Profile, Premiere Elements does not.
After upgrading to Mac OS X 10.4.8, some Intel-based Macs may have problems getting IP addresses from third-party wireless routers. While they can create their own IP address to associate with the network, they won't be able to gain Internet access. Apple says to turn the wireless router off and then back on again. This may generate an IP address. If that doesn't work, they say to check with the router manufacturer for help.
In Microsoft Excel 2003, if you have a forumula that uses the NORMDIST function, and the X value for the function is one billion or more, the formula results will show up as #NUM!. Microsoft says they have fixed this in the Excel 2003 post-Service Pack 2 hotfix package of 10/2/2006. See how to get it at http://support.microsoft.com/kb/925225.
If you upgrade a Windows Server 2003 computer with Service Pack 1, that computer may no longer be able to join its domain. It won't have any icons in the Network Places folder, and you won't be able to do any remote procedure calls. Microsoft says the problem may be that "Impersonate a client after authentication" policy has been defined for a Group Policy object (GPO) that is linked to the domain. Microsoft has workaround information at http://support.microsoft.com/kb/925632.
12/08/06 An AOL ActiveX Control Allows Attack
There is a buffer overflow bug in an ActiveX control in AOL 7, 8 and 9 that may allow a malicious website to run their code on your system. You would need to visit the website with Microsoft Internet Explorer, and AOL 9.0 Security Edition revision 4156.910 or earlier (including America Online 7.0 revision 4114.563, AOL 8.0 revision 4129.230). The bug was discovered by Secunia Research, who say that using the automatic update function for AOL will get you a version of AOL 9 that is fixed. See http://secunia.com/advisories/23043/ for the details.
If you installed Adobe Premiere Elements 3.0 on a computer that already had Premiere Elements 2.0 installed, some of the Help files may get tangled up. Ask for Help in PE 3.0, and you may be shown Help files from PE 2. Adobe shows how to get this cleared up at http://www.adobe.com/support/techdocs/333359.html.
Apple says that if you have third-party VPN client software on a Mac that is updated to Mac OS X 10.4.8, you may find that the AirPort process may suck up to 90 percent of your available CPU time. This could cause your computer to work very slowly. Apple blames the third-party software, and says you should check with them for updates. They say as much at http://docs.info.apple.com/article.html?artnum=304798, but also say to keep an eye on that page for updates.
When installing Microsoft Office 2007, sometimes there are some missing uninstall files from your previous version of Office. That means the old one won't get completely removed, and you might end up with two versions of one application. If that application is Outlook, Microsoft warns that you may have some serious instability problems. If that's the case, check out the steps you can take to clean things up at http://support.microsoft.com/kb/926799.
While in Windows XP, you can right click the desktop, click New, and then click WordPad document. Documents created in this way may be missing some of their properties if you later open the document on a Windows Vista computer. As yet, there is no fix.
Red Hat has a new jbossas package for the Red Hat Applications Stack for Red Hat Enterprise Linux 4. This package is a Jboss Application server that is used by Java applications and Web apps. The old version had a bug in the DeploymentFileRepository. Remote attackers who could gain access to the console manager could then use this bug to read or write to files. Red Hat credits Symantec for finding this bug. Get the update at http://rhn.redhat.com/errata/RHSA-2006-0743.html.
12/7/06 Security Bugs With Adobe Acrobat and Reader 7
Adobe says that Acrobat 7 and the Adobe Reader 7 have a number of critical bugs that need to be fixed. Attackers may be able to design a malicious PDF file that takes advantage of these to take control of your computer. Users of the free Adobe Reader 7 need to upgrade to the free Reader 8 at http://www.adobe.com/products/acrobat/readstep2.html. Users of Acrobat 7.x should see the fix information at http://www.adobe.com/support/security/bulletins/apsb06-20.html.
12/6/2006 Zero Day Attack Against MS Word
There is a new zero-day attack against Microsoft Word 2000, XP, 2003, Word for the Mac, and Microsoft Works. Users could only be affected if they opened up a maliciously designed Word document. Microsoft itself claims in their security advisory that attacks have been limited, but hostile code is circulating on various malware sites. We are a week away from the next Patch Tuesday, so I'm guessing that Microsoft is working fast to get a fix ready. Read more at http://www.microsoft.com/technet/security/advisory/929433.mspx.
In both Mac OS X 10.3.9 and 10.4.8, when you are installing software as as Admin user, the Installer may be able to evoke system privileges without you giving any authorization. Apple has tightened this up in their Security Update 2006-007. Now, if system privileges are needed, the Installer is going to ask for your permission first.
If you use the Apple Finder in Mac OS X 10.3.9 or 10.4.8 to browse through a shared directory, you may get a heap buffer overflow is Finder finds a corrupt .DS_Store file. Someone may be able to use this in an attack, by luring someone into browsing through a shared directory where they have booby-trapped a .DS_Store file. The overflow could then be used to run hostile code on the victim's computer. This has been fixed in the Apple Security Update 2006-007.
If you want to use Microsoft Word 2007 to create new blog posts with one of the compatible blog hosting companies, you will need to have Microsoft Visual Basic for Applications installed along with Office 2007. If not, you will see this error message when you try to blog:
Microsoft Office Word needs VBA macro language support to complete this action.
If you started out with a beta version of Office 2007 running on a computer with a beta version of Windows Vista, you may have problems with the Office 2007 Viewers after you upgrade to the final version of the product. Microsoft has workaround steps at http://support.microsoft.com/kb/928149.
If you have a Microsoft Excel workbook that has links to another workbook that has been saved in HTML format, it won't be able to update the links if the workbook is closed. If you click the Update button, you will get this error message:
This workbook contains one or more links that cannot be updated.
However, if the HTML source file is open, the links will be refreshed.
iDefense Labs found an integer overflow in Novell ZENworks Asset Management, that also affects Novell Task Server and Colleciton Server. A remote attacker may be able to exploit the bug and run their own code at either the System or Root level, which could lead to the complete takeover of the system. Novell has a patch at http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974824.htm.
Red Hat has updated GnuPG packages for Red Hat Enterprise Linux 2,3, and 4. There is a bug in the way that GnuPG decrypts messages that can be exploited by an attacker. They could send an encrypted message that, when decrypted triggers the bug and runs hostile code. This bug was discovered by Tavis Ormandy. Download the updated package at https://rhn.redhat.com/errata/RHSA-2006-0754.html.
12/5/2006 Worm Reports on MySpace
Security researchers at Websense Security Labs report on a worm that is exploiting a bug on MySpace, along with the Apple QuickTime player's support of Javascript, to infect webpages on MySpace. After the infection, links on a MySpace profile may get replaced with links to phishing sites. If you see an empty QuickTime video, or it looks like your links have been changed, you may have been infected. See http://www.websense.com/securitylabs/alerts/alert.php?AlertID=708 for more.
The Apple Security Update 2006-007 for Mac OS X 10.3.9 and 10.4.8 includes a fix for PHP, which is updated to version 4.4 with the security update. This fixes a number of bugs in PHP in the way it interacts with the Apache web server and with scripting.
There is a bug in the FTP server in Mac OS X 10.3.9. According to Apple, if FTP access is enabled, attackers may be able to learn valide account names. During the attack, trying to authenticate an unknown username won't cause a crash. However, if the username is known, the crash will occur, which may give the attackers clues for further attacks. Apple has fixed this in the Security Update 2006-007. They credit Benjamin Williams of the University of Canterbury for finding this bug.
The InfoWorld Gripe Line, by Ed Foster, has news about how some HP DesignJet printer heads are designed to fail, whether they are bad or not. Read about it at http://weblog.infoworld.com/gripeline/archives/2006/12/hps_timebombed.html.
There is a bug in the way that the Google Mini Search Appliance and the Google Search Appliance handle UTF-7 encoded URIs. Attackers can take advantage of that to run both hostile HTML and script code within a browser session. Secunia has more at http://secunia.com/advisories/23239/. As a fix, they recommend filtering malicious characters and character sequences in a proxy. They credit maluc with finding this bug.
Google personalized home pages will work on more than just the latest browsers. It is compatible with Microsoft Internet Explorer 5.5 and later, with Mozilla Firefox 0.8 and later, Safari 1.2.4 and later, Netscape 7.1 and later, and Opera 8 and later. You won't get the full effects for dragging content around on your screens if you don't have JavaScript turned on, however.
If you use a client-only rule within Microsoft Outlook 2007 to delete meeting requests, you may end up with tentative appointments still showing up in your Outlook 2007. Yet you will correctly see those meeting requests in your Deleted Items folder, too. The only workaround from Microsoft so far is to manually delete the tentative meeting requests.
If you format a blank DVD with a Windows Vista computer, you won’t be able to stream live TV and record to the DVD using a regular standalone DVD recorder. According to Microsoft, Vista uses a Universal Disk Format (UDF) that won't work with Real-Time files, which is what the DVD units use.
12/4/2006 Update Windows XP Media Center to Appease Zune
You will not be able to install the Microsoft Zune software on a Microsoft Windows XP Media Center 2005 computer unless you have installed the Rollup Update 2. Without it, you will get this blunt error message: "Operating System Not Supported"
To achieve compatibility, get the update at http://support.microsoft.com/kb/900325. Also, the Zune software is totally incompatible with both Windows XP Media Center Edition 2002 and Microsoft Windows XP Media Center Edition 2004. If you are using those versions, I guess you can always stick with iTunes.
If you installed the Adobe Illustrator 12 Tryout version and then removed it, you may have problems later upgrading Illustrator CS2 with the Illustrator 12.0.1 update. During the upgrade, you will see the error message: The tryout version cannot be updated. Adobe has two fixes for this. Find the Adobe ESDGlobalApps.XML file and delete it, or delete the Illustrator tryout version uninstall Registry key. See http://www.adobe.com/support/techdocs/328994.html for the details.
On both Mac OS X 10.3.9 and 10.4.8, if you have PPPoE enabled on an untrusted local network, one of the other users on this network may be able to cause a buffer overflow on your computer. This could lead to a computer crash, or possibly running hostile code on your computer. Apple has fixed this in the Apple Security Update 2006-007. They credit Mu Security for finding this bug.
If you create a personalized Google home page, but do it without logging in to Google via the Sign In dialog, all your personalized home page settings are stored in cookies. If your cookies get deleted, your personalized settings will be get lost. See http://google.com/support/bin/answer.py?answer=25563&topic=9004 for more.
If you've decided to migrate from Apple iTunes to the world of Microsoft Zune, note that none of the content that you've purchased from the Apple iTunes store can get transferred. That's because it uses the Apple DRM (digital rights management) scheme, instead of the Zune DRM. Any unprotected content can get transferred. See how at http://support.microsoft.com/kb/928224/en-us?sd=zune. Also note that content from the earlier Microsoft DRM system isn't compatible either.
If you upgrade to Windows Vista, on a computer that has a PS/2 keyboard, you may find that the computer is very slow to accept keystrokes from the keyboard, or may delay and then accept them in a burst. According to Microsoft, the keyboard settings don't get converted correctly during the upgrade. Microsoft has steps to fix this at http://support.microsoft.com/kb/927840.
Symantec has patched their Symantec Veritas NetBackup PureDisk Remote Office Edition 6.0 to fix a PHP bug. According to Symante, unauthorized users may be able to execute their own code in the context of the server, which may allow them to introduce their own damaging code. This has been fixed in the Symantec Veritas NetBackup PureDisk Remote Office Edition 6.1. Get it at http://support.veritas.com/docs/285984.
12/2/2007 Vista and Office 2007 Upgrade Together Brings Bugs
If you have upgraded to Windows Vista from Windows XP, and then on the same computer upgrade to Microsoft Office 2007 from some earlier version of Office, you may have a problem doing searches in Outlook 2007. If Outlook 2007 uses Rich Text Format (RTF) as its file type, none of your searches will find results within RTF messages. Microsoft has a fix for this. See the details at http://support.microsoft.com/kb/927595.
Adobe says that if you install Premiere Elements 3.0, when you enter in your company name make sure it is less than 50 characters long. If it is longer, then when you first launch the program you will get this error message: Registration information is invalid, reinstall Premiere Elements.
Opening a PDF file with Adobe Acrobat 8 on a Windows XP computer with an ATI video card may cause a Blue Screen of Death on the computer, with this error message:
There was an error processing a page. Insufficient system resources exist to complete the requested service.
Adobe says this can happen if the ATI video card is using their 8.291 driver, and your Acrobat Page Display preferences are set for Use 2D GPU acceleration. Adobe says you will either need to upgrade the video driver, or turn off 2D GPU acceleration. See how to do that at http://www.adobe.com/support/techdocs/324073.html.
Apple says that within the Security Framework for Mac OS X 10.3.9, the Secure Transport mechanism is supposed to figure out the best cipher system that this computer and the other computer can support. However, sometimes there's an error, and the two computers end up using a relatively lax system when a better one could be used. This has been fixed in the Apple Security Update 2006-007. Apple credits Eric Cronin of gizmolabs for finding this bug.
There is a bug in the gnuzip application that ships with Mac OS X 10.3.9 and 10.4.8. An attacker may be able to construct an archived file in such a way that when gnuzip unpacks it, gnuzip may crash. There's also the possibility of the attacker running their own code on your computer. This has been patched in the Apple Security Update 2006-007. Apple credits Tavis Ormandy of the Google Security Team for finding this bug.
Increased security was one of the goals for Windows Vista. (It was also one of the goals for Windows XP Service Pack 2.) For a detailed review of the new security features of Windows Vista, see Paul Thurott's Supersite at http://www.winsupersite.com/reviews/winvista_05b.asp. (Don't wait for my review -- I don't plan on getting a Vista computer for quite a while.)
12/1/2006 Vista Officially Launched, And Threat Identified
Microsoft officially launched Vista on November 30. That's also the day that the anti-virus firm Sophos said that some malware already known to be on the Web can bypass Vista's defenses if downloaded through third-party Web-based email. Even if the malware gets through, however, other parts of Vista may still be able to stop it from causing damage. Read the whole thing at http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005542.
Copyright 2003-2007 BJK Research LLC