MicroSoft no longer providing patches to pirates
If you visit windowsupdate today you will probably be invited to install.
Windows Genuine Advantage Validation Tool (KB892130)
From the microsoft website:
"The Windows Genuine Advantage Validation Tool enables you to
verify that your copy of Microsoft Windows is genuine. The tool validates
your Windows installation by checking Windows Product Identification and
Product Activation status. After you install this item, you may have to restart your computer.
Once you have installed this item, it cannot be removed."
"Concerned about privacy? When you check for updates, basic information about your computer,
not you, is used to determine which updates your programs need.
To learn more, see our privacy statement."
This last statement is intended to address privacy issues. While a "nice" statement many of us
would like to know EXACTLY what is collected and transmitted to microsoft by this licence tool.
In my opinion Microsoft is well within their rights to require licence proof before providing patches.
Upgrade to 0.10.12. Right now! Or at least before you need to use ethereal again.
Due to the severity and scope of the defects
that have been discovered, no workaround is available.
Who's SAPing you
A vulnerabiltiy was announced for SAP/r3
The vulnerability is caused due to an input validation error in the
Internet Graphics Server (IGS) subcomponent when processing document paths.
This can be exploited to access arbitrary files on the system outside the
web root by supplying a document path containing a directory traversal sequence (../).
The vulnerability has been reported in SAP prior to version 6.40 Patch 11.
This comes from a blog so take it for what it is worth.
The first "scandal" to emerge from Black Hat 2005 (so far, at least)
is the omission of some 30 pages of text from the 1,000-page-plus conference
presentation materials, which were handed out to conference attendees when
they registered on Tuesday. The missing pages -- literally ripped from the
massive handout -- apparently detailed the specifics of a serious security flaw
present in Cisco Systems routers, devices
that route the majority of Internet traffic on the Web today
The only "official" comment on the missing pages on the Cisco flaw
was a photographed copy of a notice distributed with each bundle of
conference materials. The notice states:
"Due to some last minute changes beyond Black Hat's control, and
at the request of the presenter, Michael Lynn,
the included materials aren't up to the standards Black Hat tries to meet.
Black Hat will be the first to apologize. We hope the vendors involved will follow suit."
Who is Mike Lynn?
Mr. Lynn is a well known vulnerability researcher for Internet Security Systems,
He is credited with finding several vulnerabilities in cisco products.
He is quoted here on router worm potential.
Our own Joshua Wright states
Note that Mike Lynn was going to present on exploiting IOS to use vulnerabilities in code
to run arbitrary code of the attacker's choosing. This is a huge deal, since a problem
with IOS that was formerly limited to a DoS could be leveraged to add configuration
commands to the IOS configuration, or other nasty things.
Mike resigned from ISS and gave his talk.
"Cisco respects and encourages the work of independent research scientists;
however, we follow an industry established disclosure process for communicating
to our customers and partners, the company said in a statement released Wednesday.
It is especially regretful, and indefensible, that the Black Hat Conference organizers
have given Mr. Lynn a platform to publicly disseminate the information he illegally obtained."
Jul 28th 2005
1 decade ago