« June 2007 | Main | September 2007 »
Here are the links to some recent posts on the First Step Blog:
From the Washington Post Security Fix Blog
Microsoft Corp. today pushed out software updates to plug at least 11 separate security holes in its Windows operating system and other software.
Windows users can grab the updates via the Microsoft Update Web site, through Automatic Updates, or download individual patches from the Microsoft Download Center.
Four of the vulnerabilities earned a "critical" rating from Redmond, its most severe. Microsoft labels flaws "critical" if they can be exploited remotely with little if any help from the user.
Updates are available for most versions of Windows 2000, Windows XP, Windows Server 2003, and Microsoft Office.
Four of the flaws reside in Office, from Office 2000 all the way up to the latest -- Office 2007. Office patches also are available through Microsoft Update, unless you're an Office 2000 user, in which case you'll need to pay a visit to the Office Update site to complete this month's patch cycle. Office 2000 users also may need to have their Office installation CD handy to finish the installation.
One interesting vulnerability patched today stems from a problem with the firewall built into Windows Vista PCs. From the advisory, there is an "information disclosure vulnerability in Windows Vista that could allow a remote anonymous attacker to send inbound network traffic to the affected system. It would be possible for the attacker to gain information about the system over the network." Microsoft notes that an attacker would still need to know a valid user name and password for the targeted Vista system to access any programs or other resources on the machine.
Companies often take anywhere from a few days to a few weeks to deploy patches, allowing time to test the updates to be sure that they do not break existing software applications. But home users should not delay in applying these updates. If you've heeded my oft-uttered advice to run your system under a limited user account, you will need to log in using an administrator account to install patches.
From the Washington Post Security Fix Blog
Apple has released a new version of its ubiquitous QuickTime player for both Mac OS X and Microsoft Windows computers. The latest version, v. 7.2, plugs at least eight security holes in the software.
QuickTime vulnerabilities that span both operating systems may present a very attractive target for malicious hackers, as the program is installed by default on all Apple machines, and on most Windows PCs (if you have iTunes installed, chances are you also have QuickTime on your system). Indeed, recent automated attack tools have been found to exploit QuickTime flaws.
Mac users can grab the latest, patched version using the built-in Software Update feature. Windows users should be able to fetch the patches using the Apple Software Update program that comes bundled with most relatively recent versions of QuickTime and iTunes.
From the Washington Post Security Fix Blog
Adobe and Sun Microsystems have issued updates to fix security problems in their Flash Player and Java applications, respectively. Flash and Java are some of the most widely installed third-party software applications on the planet, so it's a fair bet that criminals could soon be targeting these holes to break into vulnerable systems.
The Adobe update, released July 10, brings the Flash Player to version 9.0.47.0. Users can check for the presence of Flash on their machines and tell which version is installed by visiting this link. Any installation lower than 9.0.47.0 needs to be updated.
The latest Windows version is available for download here. Anyone still using Microsoft Windows 95, Microsoft Windows NT, or classic Macintosh operating systems will need to download the 7.x updater, from this link here. The update for Mac OS X, Linux, Solaris and other operating systems is available here.
The Java update can be installed from the Java.com home page. Click on the "Do I Have Java?" link to see if your machine has the latest version (Java Version 6, Update 2). Clicking on the "Download Now" button successfully installed the latest version of the Java plug-in for both Mozilla Firefox and Microsoft's Internet Explorer browsers on my machine (if you've taken my advice to run your Windows system under a limited user account, you will need to log in using an administrator account to apply these updates).
Windows users who install the latest version of Java will notice that its entry in "Add/Remove Programs" now calls the program simply "Java (TM) 6 Update 2." Previously, those entries read "J2SE Runtime Environment," or something to that effect. Bill Curci, the Java SE product marketing manager, said Sun made the change in response to feedback from users who were confused by the various Java product names, such as J2SE, JRE, JDK.
Windows users should remove any older versions still installed on their machines, as Sun's installer does not eradicate older versions of the software, which can occupy hundreds of megabytes of disk space. Worse yet, older versions of Java hanging around on systems have in the past left even fully patched Java installations vulnerable to attack. After updating one of my home PCs with this latest version, I found that it had no fewer than four previous versions of Java installed. Each can be safely removed via the "Add/Remove Programs" feature, accessible in Windows systems from the system Control Panel.
Apple licenses Java for use in Mac OS X systems, but the company is responsible for shipping custom versions of the software, so Mac users will need to wait until Apple issues its own update.
From the Washington Post Security Fix Blog
Mozilla has shipped a new version of its popular Firefox Web browser to plug multiple security holes. The fixes embedded in the latest iteration of Firefox, version 2.0.0.5, are not included in older versions of Firefox (e.g., 1.5.x and lower), so those users will need to upgrade to the latest 2.0.0.5 release to be fully protected.
In all, Mozilla fixed at least seven security vulnerabilities in its latest release, including a flaw Security Fix wrote about last week that uses the Microsoft Internet Explorer browser to trick Firefox into opening up a variety of dangerous security holes.
Unless you are using a version of Firefox earlier than 1.5.x, you should soon be prompted to upgrade to the latest version. If this doesn't happen (it may take a few more hours for Mozilla to push out the auto-updates), you can always try upgrading by selecting "Help" and then "Check for Updates." Mozilla notes that some of your Firefox extensions (or "add-ons" as they're now called) might not work until updates for them are made available.
Recent Comments