Microsoft Security Advisory 971778

Microsoft has released Security Advisory 971778 directed to a vulnerability in Microsoft DirectShow which could allow remote code execution if a specially crafted QuickTime media file is opened.

Microsoft is aware of limited, active attacks that use this exploit code. At this point in the investigation so far Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable. All versions of Windows Vista and Windows Server 2008 are not vulnerable.

Work-around Options:

1. If you are using Windows 2000, SP4, Windows XP or Windows Server 2003, please see the Fix it provided to disables QuickTime parsing. After a security update is released, return to this link and click the automatically on a computer that is running Windows 2000, Windows XP or Windows Server 2003, click the "disable workaround".
2. Use WinPatrol to disable QuickTime. See WinPatrol Features.

References:

• Advisory: Microsoft Security Advisory (971778): Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution
• Fix it: Microsoft Security Advisory: Vulnerability in Microsoft DirectShow could allow remote code execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

The sound of found: Bing!

As you can see with a glance to the right, I removed the Live Search image and replaced it with the brand new logo for Bing, the new Microsoft search engine.

Making the top trends in Twitter today has been the sound of Bing. In fact, that is the idea behind the title of the introduction to Bing at the Live Search blog:

"Why did we pick Bing as the new brand name? We needed a brand that was as fresh and new as our approach. It needed to be like the product — optimized for the Internet. A name that was memorable, short, easy to spell, and that would function well as a URL around the world. We like Bing because it sounds off in our heads when we think about that moment of discovery and decision making — when you resolve those important tasks. And frankly, the name needed to clearly communicate that this is something new, to invite you to come back, to re-introduce you to our new and improved service and encourage you to give it a try."

Learn more about Bing at Why Bing?.

Update: Listen to Apple co-founder Steve Wozniak in Woz Bing! Apple Co Founder a "Big Fan" of Microsofts New Search Engine

References:

• Bing Virtual Presskit
• Microsoft’s New Search at Bing.com Helps People Make Better Decisions
• The sound of found: Bing!

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

The Tech Herald: Criminals using Comodo to attempt legitimacy

In his report on the recent Comodo controversy, The Tech Herald writer, Steve Ragan, added information everyone else missed:

The ten thousand dollar question, which no one asked of Mr. Abdulhayoglu, was why Comodo offers DV certificates free for 90-days.

“A free SSL certificate will secure your site and begin building trust,” Comodo’s site states, adding that a free SSL certificate is, “the same as our paid Essential SSL” They even promise no, “faxes, no paperwork and no delays - get the golden padlock within minutes and be ready to sell online.” How is this not making an offer to encrypt data for a recipient you have not verified?

Mr. Ragan also contacted VeriSign since they were mentioned in the discussions. A VeriSign spokesperson told The Tech Herald, “RapidSSL, Thawte, and GeoTrust are the only brands VeriSign issues DV certificates from.”

This additional information was provided by VeriSign, further illustrating that poor practices are not in place by other certificate authorities:

“The system we have in place automatically rejects obviously fraudulent sites and kicks anything questionable to a manual approval. And if anyone flags a site as malicious, we have a team that investigates these and revokes the certificate if found to be malicious/fraudulent.”

Jay Schiavo, Product Manager at VeriSign, mirrored that thought by adding, “For GeoTrust and RapidSSL we have the ability to revoke a cert issued to a malicious or rogue site instantaneously. The cert will then show up on our CRLs immediately."

Read Steve Ragan's article in The Tech Herald: Criminals using Comodo to attempt legitimacy





Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...