Click here to receive your FREE subscription to Campus Technology
News
Microsoft Releases 6 Critical Patches
2/14/2008
For the February security bulletin release, Microsoft rolled out six "Critical" fixes--rather than the seven detailed in the advanced notice--and five "Important" items.
This month's 11 patches--said to fix 17 total bugs--are the most Windows IT pros have seen since August, and with a greater variation of vulnerability plugs than at any time in the last 12 months, according to security experts.
"After several slow Patch Tuesdays, administrators are faced with the most patches they've seen in a year," said Paul Zimski, senior director of market strategy at Scottsdale, Ariz.-based Lumension Security. "Because so many critical patches affect so many applications--including Office, Internet Explorer and the operating systems themselves--these are widespread enough to have a bigger effect and they are going to require the utmost attention and energy."
Moreover, Zimski added, with many remote code execution flaws that don't require end user consent, the potential for malware, botnets and rootkits is rampant.
The first critical issue is said to solve what Redmond said was a "privately reported vulnerability" in the Web-based Distributed Authoring and Versioning Mini-Redirector, or WebDAV Mini-Redirector. WebDAV, which enables users to manage Web files on remote servers, is a set of extensions of hypertext protocol most commonly known as "http:." This RCE implication constitutes a hacker's dream in a scenario where attackers can get in and take complete control of a system, manage and edit files and create new accounts with elevated user rights. The issue affects all Windows OS versions with the exception of Windows 2000 SP4.
Critical patch No. 2 also resolves an internally reported hole. It's designed to thwart attacks on Object Linking and Embedding (OLE) Automation, which is a proprietary software feature from Redmond that allows linking to documents, data and other objects on the Windows Component Object Model. For developers, it serves as a way to customize user interfaces. With a specially crafted Web page, an attacker could execute malicious code through OLE but the vulnerability would only really be damaging if it were to affect user workstations that have administrative profile parameters. The fix is for Windows, Office and Visual Basic programs on all OS versions, though only Windows 2000 SP4 and all editions of XP and Vista were labeled as "critical."
Yet another private vulnerability plug is designed to block bad code embedded in specially crafted Word documents. A user could send a Word file, get it opened by an unsuspecting user, and then gain access, going willy-nilly. The vulnerability mainly affects Office SP3, Office XP SP3 and Office 2003 SP2.
The popular browser Internet Explorer was late last year plagued with problems, and now the fourth critical bulletin will hopefully address most of those issues. Specifically, Redmond says this cumulative patch addresses three private bugs and one publicly reported one. Although these fixes--affecting all versions of IE up to and including IE 7 for Vista--are yet to be specified, once that patch is installed what's fixed and not fixed will come out in the rinse, security experts contend.
Recommended Reading
- Sun, Stanford Working To Archive History
In May in San Francisco, experts from leading universities, libraries, and research institutions around the world met as part of an ongoing effort to address a pressing issue: archiving the world's history, right up to today.
- The Quilt Coalition Rolls Out XO Communications for High-Capacity Network Services
The Quilt, a coalition of 28 regional network organizations, has added XO Communications Services to its authorized vendor list. The Quilt represents 200 universities and thousands of other educational institutions across the United States. With this new relationship, Quilt members can purchase XO's high-speed IP transit and network transport services at competitive rates.
- Wimba Classroom 5.2 Expands Classroom Capture Support, Adds MP3 Downloads
At the NECC 2008 conference in Texas this week, Wimba launched a new version of Wimba Classroom, the virtual classroom component of the company's Collaboration Suite. The new 5.2 release expands options for classroom capture and adds a variety of other functional and ease of use features.
- Automation Chimera: Education Is Not Management
The lure of automating workflow online so human intervention is minimized is continually reinforced in the minds of higher education administrators by examples of automated campus systems such as financials, student information systems, and other enterprise systems. But what's good for management is not always good for learning.
- Cognos Releases BI Software for Linux-based IBM System z Mainframe
Cognos, which IBM acquired in January, has released an update to its business intelligence software that will run on the Linux operating system on IBM System z mainframes. IBM Cognos 8 BI was being developed by the two companies prior to the acquisition, but assimilation of Cognos into IBM accelerated development.
- Facebook and Collegiality: A Serendipitous Social Niche
Facebook is a way to greet a colleague as if she or he is on your own campus: a wave at a distance, a hello at the corner burrito place, a honk as you both leave the campus parking lot. Informal collegiality has been extended over the miles.
