Microsoft releases critical fixes for Windows, Office holes

Microsoft issued two critical bulletins on Tuesday fixing holes in its e-mail programs and the Visual Basic for Applications programming language implementation built into Office.

Bulletin MS10-030 resolves a vulnerability affecting Outlook Express, Windows Mail, and Windows Live Mail that an attacker could exploit by compromising a mail server, hosting a malicious mail server, or performing a man-in-the-middle attack to intercept communications between the client and the server.

Bulletin MS10-031 fixes a hole in Microsoft Visual Basic for Applications (VBA) that could allow an attacker to remotely run code if a host application opens and passes a malicious file to the VBA runtime environment. The update resolves the problem by changing the way VBA searches for ActiveX Controls are embedded in documents.

Successful exploits of the vulnerabilities at the heart of the bulletins could allow an attacker to take complete control of a computer, Microsoft said in its bulletins summary advisory. The bulletins affect Windows 2000, XP, Vista, Windows 7, Server 2003, Server 2008, Office XP, Office 2003, 2007 Microsoft Office System, Microsoft Visual Basic for Applications, and Visual Basic for Applications software development kit. However, Windows 7 and Server 2008 R2 customers are not vulnerable in their default configurations, the company said in a post on the Microsoft Security Response Center blog.



Microsoft is still working on a fix for a vulnerability in SharePoint Services 3.0 and SharePoint Server 2007 that was disclosed late last month and which could lead to a cross-site scripting attack via the browser. Proof of concept exploit code has been published for that.

"I've put the Visual Basic for Applications vulnerability first on my list," said Joshua Talbot, security intelligence manager for Symantec Security Response. "Both vulnerabilities require social engineering to exploit, but the VBA vulnerability requires less action from a user. For instance, an attacker would simply have to convince a user to open a maliciously crafted file--likely an Office document--which supports VBA, and the user's machine would be compromised. I can see this being used in targeted attacks, which are on the rise."

Meanwhile, the other vulnerability requires a user to actually open up Outlook Express or Windows Mail and connect to a malicious mail server, he said. "It's possible that an attacker could somehow convince a user to do this--for example by enticing them to sign up for a new free mail service--but the steps required to do so would probably be a red flag for most users," Talbot added.


Read ON

Twitter confirms awkward 'auto-follow' bug


It's been a Monday of social-media security embarrassments: Twitter has confirmed the existence of a bug that can force one user to follow another.

The bug appears to have originally been noticed by a Turkish blog, followed by the blog Webrazzi, which successfully tested it out and forced the Twitter accounts of industry luminaries like Facebook founder Mark Zuckerberg and Twitter CEO Evan Williams to follow a dummy profile. The flaw allowed members to add followers to their own accounts, basically, by tweeting "accept" followed by "@" and any given Twitter user name.

Twitter spokesman Sean Garrett told CNET that the bug is "unfortunately" real, and that "we're focused on fixing it now (and) hope to know a lot more about the specifics once that's done."

As a result, it's not yet clear how long the bug had been in existence or whether it could potentially give Twitter users access to the contents of "protected" accounts in which all tweets are private.

Update at 9:53 a.m. PDT: Gizmodo notes that this only worked in Twitter's Web interface, not on third-party apps. Meanwhile, I forced Ashton Kutcher to follow me--but a moment later, Twitter appeared to have delved into the issue and had reset follower and following number counts to 0. Temporarily, we can only hope!


Read ON

Microsoft Predicts Fastest-Ever Adoption of New Office Software

May 12 (Bloomberg) -- Microsoft Corp. expects customers to adopt the new version of Office at the fastest pace in the software’s 20-year history, helping reverse a sales slump and fend off competition from Google Inc.’s Web-based programs.

The software has been tested by 7.5 million users, three times as many as any previous version, signaling that adoption will be quick, said Chris Capossela, a senior vice president in the Office group. Users are also likely to upgrade to the new package of business software at the same time they install Windows 7, released last year, he said.

“This version will be the best ever in terms of adoption speed, both because of the interest we are seeing and the Windows 7 adoption curve,” Capossela said in an interview last week. Redmond, Washington-based Microsoft, the world’s largest software maker, will hold an event in New York today to mark the official release of Office 2010 to businesses.

Microsoft’s $19 billion business division, which gets most of its revenue from Office, could use the boost. Its sales will drop 3 percent in the fiscal year ending in June, estimates UBS AG analyst Brent Thill. While the new software will spur orders in the coming year, the comeback will hinge on whether businesses recommit to technology spending -- something they’ve been slow to do in the wake of the recession.

‘Precarious Recovery’

“It’s still a precarious recovery,” said Sarah Friar, an analyst at Goldman Sachs Group Inc. in San Francisco, who recommends buying Microsoft shares. “We’re in the camp of expecting a more moderate migration. It’s kind of, ‘steady as she goes.’ It’s not a raging rush to upgrade.”

Microsoft said last month that a recovery in corporate spending on personal computers and software was just beginning. Multiyear contracts, which account for 60 percent of the Office unit’s sales, are still taking longer to close because businesses are keeping a lid on expenses.

Home-computer shoppers have fueled the PC industry’s rebound so far, snapping up laptops and netbooks.

“I wish I could predict what business PC adoption is going to be,” Microsoft’s Capossela said. “It’s wonderful to see consumers buying PCs in such numbers. That sets us up for a great consumer uptake. The business uptake will also be excellent, but businesses are certainly slower to start spending money again.”

Aging Software

More than half of Office customers now use a version of the program that’s at least seven years old, giving Microsoft an opportunity to get them to switch, Thill said. For the year starting July 1, the new Office will spur an increase of 12 percent for the business division, he predicts.

For the first time, Office will include Web-based versions of popular programs like Word and Excel. The company already has 40 million users of Internet-delivered versions of its Exchange e-mail server and SharePoint server programs, which let customers’ employees create internal company websites and collaborate on projects.

Office 2010 also adds the ability to edit photos and videos in PowerPoint presentations, and co-authoring features let different people work on one file at the same time. Users can select an option to save documents on the Internet, so they can be retrieved when employees are away from the office.

Customers also can broadcast PowerPoint slide shows over the Internet to any user with a Web browser. The Outlook Social Connector turns the e-mail program into a central repository for data from sites like Facebook, MySpace and LinkedIn.

Google Apps

Adding Internet features gives Microsoft fresh ammunition against Google, which has targeted Office customers with its Internet-based Google Apps.

Businesses that already have Office 2007 should just update it with Google Apps to add Internet and collaboration features, Google says. Many workers don’t need a new version of Office, or any version at all, said Chris Vander Mey, a product manager at Mountain View, California-based Google.

“Office is a really good product and every company should have two or three copies,” he said. “But there’s a significant number of employees that don’t need it.”

Google says 3,000 businesses sign up each day for its apps. The company lands a large corporate customer every few weeks, mostly for the Gmail e-mail service, said Andrew Kovacs, a Google spokesman. Recent new customers include packaging company MeadWestvaco Corp. and Air France-KLM Group’s KLM unit, which will have its 11,200 crew members use Gmail.

Capossela said Office programs like Outlook and Word are used by the bulk of workers at Microsoft’s corporate customers. Most employees don’t want to switch to Google, he said. Uploading a file to Google Apps often doesn’t preserve details and formatting, Capossela said.

Microsoft’s push into Web-based programs is motivated more by customer demand than competition with Google, said Goldman Sachs’s Friar. Growth in software delivered as an Internet service is going to outpace standard programs by 5-to-1, she said.

“It’s a must for them to have done it -- the world is moving to software as service,” she said. “It’s the biggest shift in the software market.”


Read ON

Page Navigation

 
span.fullpost {display:none;}