Month: December 2006

“Microsoft’s security response center has confirmed that a second zero-day vulnerability in its Word software program is being targeted by unknown attackers. The latest flaw comes just days after the software maker issued a security advisory to warn customers against opening Word documents from untrusted sources. The two vulnerabilities are entirely unrelated. The flaws were discovered during actual code execution attacks against select targets and highlight the Redmond, Wash., vendor’s struggle to cope with gaping holes in one of its most widely used products. According to a US-CERT advisory, the latest bug is a memory corruption issue that occurs when a Word file is rigged with malformed data structures. No other details were made available. Microsoft has not yet issued a formal prepatch advisory but, in a blog entry, Security Program Manager Scott Deacon listed affected software versions as Word 2000, Word 2002, Word 2003 and the Word Viewer 2003. He said Microsoft Word 2007 is not affected by the second vulnerability. ‘From the initial reports and investigation we can confirm that the vulnerability is being exploited on a very, very limited and targeted basis,’ Deacon added.”

Double Trouble: Microsoft Confirms Another Word Zero-Day Flaw

There you go… yet another reason to go to OpenOffice.org! ‘Nuff said.

Microsoft has been getting slammed again with exploits… and they are pushing to get a lot of important updates out next Tuesday… so get ready to update via Windows Update!

Microsoft to Ship 6 Security Bulletins, 2 Critical

“Microsoft reported on Dec. 7 that it will ship six individual security bulletins as part of its monthly Patch Tuesday update next week, with at least two of the fixes aimed at addressing critical issues in its products. In a preview of the patch release scheduled for Dec. 12, Microsoft said it would release five bulletins targeting vulnerabilities in its Windows operating system, at least one of which will address a flaw ranked by the company as critical, its most severe security rating. The sixth bulletin released by the company will attempt to close a critical hole in its Visual Studio development package.”

Have you downloaded the new beta of Paint.NET? Dewd! You have to check it out! I have seen full blown, purchased software products that aren’t this cool and polished! And, it is FREE! If you have the older version installed it will uninstall that, then install the new version. This is still just a beta release, but I must say, I like where they are going with it! They have a very active community forum, and they are responding to bug reports and suggestions really well! Keep up the great work, guys! More about this project on the Podcast when I record it this Saturday… in response to an e-mail question I received. This is WAY more than just a photo editor!

Get Paint.NET

I am a long-time TechTV fan! I remember watching James Kim do “lab-rat” segments on TechTV. He was such a nice, personable guy on the air. Apparently he was in real-life as well. He and his family were missing since shortly after Thanksgiving. His family was found with their car, but he had left the car to go try and get help. With the snow, and other poor weather conditions, he just didn’t make it.

Searchers Find Body Of Missing SF Man

Our thoughts and prayers are with the Kim family. This is really a shame. It is nice that the “tech community” pulled together in concern and interest in this story… and I am so grateful that his family is safe… I just wish the news had been better for James himself. James was 35.

That’s what it looks like from here. SCO’s evil lawsuit to try and destroy Linux has been beaten on over and over recently. Now, it looks like Novell may have the last word.

Another Day, Another Knockout Punch Aimed at SCO

“Last week saw the end of most of The SCO Group’s claims that IBM contributed Unix code to Linux. ‘Now, Novell has filed a motion that undercuts all of SCO’s contract claims against IBM, based on a ‘silver bullet’ clause in the original sale of Unix to SCO. In its latest legal move against SCO, Novell on Dec. 1 filed for partial summary judgment against SCO in its own case. In this motion, Novell is asking the U.S. District Court to rule that the Unix APA (Asset Purchase Agreement), which sold Unix from Novell to SCO, gave Novell the right to waive SCO’s contract claims. Novell had long claimed that it never sold Unix’s IP (intellectual property) rights to SCO. This new motion, however, isn’t connection with those claims. In the APA, Novell has what Mark Radcliffe, co-chair of the Technology and Sourcing Practice Group at the law firm DLA Piper, called, when Novell first made these claims, a ‘silver bullet’ provision under the APA to block SCO’s actions under these licenses. ‘This provision permits Novell to amend, supplement, modify or waive provisions of the Unix licenses sold to SCO,’ Radcliffe said. ‘Novell also retained the unusual right to require SCO to follow its directions to amend, supplement, modify or waive these licenses and, if SCO does not comply, Novell can do so on SCO’s behalf.'”

Ba-da-bing – Ba-da-boom! SCO is history! I love it!

DON’T OPEN THAT WORD DOC! That’s what Microsoft is saying. Yep, you read that right. Microsoft is saying NOT to use Word! Yep… if ever there was a time to switch to OpenOffice.org, that time is NOW!

Microsoft Issues Word Zero-Day Attack Alert

“Microsoft on Dec. 5 warned that an unpatched vulnerability in its Word software program is being used in targeted, zero-day attacks.

A security advisory from the Redmond, Wash., company said the flaw can be exploited if a user simply opens a rigged Word document. Affected software versions include Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac and Microsoft Word 2004 v. X for Mac. The Microsoft Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word. There are no pre-patch workarounds available. Microsoft suggests that users ‘not open or save Word files,’ even from trusted sources. ‘As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources,’ the company said. Users who have installed and are using the Office Document Open Confirmation Tool for Office 2000 will be prompted with Open, Save or Cancel before a file is opened. This offers a minor warning mechanism for Word users. The high-risk alert comes exactly one week before the company’s scheduled December Patch Tuesday, but there is no word yet from Microsoft on the timing of its fix for Word.” (Emphasis mine.)

The “fix” is simple: OpenOffice.org. Download from the link below:

OpenOffice.org

This guy has developed an MS-Paint (nearly EXACT clone) as a web application!

Canvas Paint

He says: “A near pixel-perfect copy of Microsoft Paint in HTML, CSS and JavaScript, using the ‘canvas’ tag as specified by WHATWG and supported by Safari 1.3, Firefox 1.5 and Opera 9. This web app is not authorized by, supported by or in any way affiliated with Microsoft.” The programmer is Christopher Clay. Hat’s off to you, dewd!