Patched security flaws.
Secunia Advisory: SA24205
Release Date: 2007-02-24
Last Update: 2007-02-26
Critical: Highly critical
Impact: Security Bypass, Cross Site Scripting, Spoofing, Exposure of sensitive information, System access
Where: From remote
Solution Status: Vendor Patch
Software: Mozilla Firefox 1.x Mozilla Firefox 2.0.x
Solution: Update to version 2.0.0.2 or 1.5.0.10
mozilla.com
We strongly encourage all users to upgrade to Firefox 2
Opening FireFox, users of supported versions 2.x and 1.5.x should receive an alert that updates are available or have been installed, depending on your settings.
If you have not received the update, you may be running an older, unsupported version of Firefox such as version 1.0.x. To check your version, click “Help” and then “About Firefox.”
An unsupported system is extremely insecure so make sure you upgrade.
Known Vulnerabilities in Mozilla Products.
What’s New in Firefox 2.0.0.2
Windows Vista Support: Many enhancements and fixes for Windows Vista are included along with the following caveats.
by certifiedbug on February 24, 2007
in News
From the header on Daniel Axelrod’s blog:
My goal is to give readers the news they crave from the local schools.
Axelrod is the Norwich Bulletin’s education reporter who previously wrote a rant on his blog condemning Julie Amero.
Paperghost writes:
He eventually pulled his blog entry, but this didn’t really solve anything. So in the spirit of public enquiry, I left the following comment on his blog yesterday:
“So, why DID you remove your poorly written rant about Julie Amero?”
Well, knock me sideways with a bag of angry monkeys - everything has been pulled and his blog now only contains one entry!
Vitalsecurity Article
by certifiedbug on February 23, 2007
in Microsoft
REDMOND, Wash. — Feb. 22, 2007
In the wake of the largest product launch in the company’s history, that of the Windows Vista™ operating system, the 2007 Microsoft® Office system and Exchange Server 2007, Microsoft Corp. will host the 2007 MVP Global Summit. The annual event recognizes the value that Microsoft-designated Most Valuable Professionals (MVPs) around the world provide in helping to make the company’s products successful, while honoring their contributions to the objective exchange of knowledge and their dedication to enriching the technology user experience.
Scheduled for March 12 to 15, the 2007 MVP Global Summit will be held at the Washington State Convention and Trade Center in Seattle and at Microsoft’s headquarters in Redmond, Wash. The event will kick off with a keynote address by Microsoft Chairman Bill Gates. More information can be found at http://mvp.support.microsoft.com/MVPsummit.
Microsoft PressPass
by certifiedbug on February 23, 2007
in News
Attorney John Cocheo, who defended Amero last month during her trial in Norwich Superior Court, said Wednesday he has enlisted aid from New Haven attorney William Dow before the March 2 sentencing and the appeal process. Amero faces up to 40 years in prison.
“He’s one of the top lawyers in the state,” Cocheo said of Dow.
A formal request for a postponement will be submitted to Judge Hillary Strackbein, he said, to allow Dow time to become familiar with the case. He expects a response by next week.
Article: Norwich Bulletin
The Julie Amero Tragedy (PDF)
By Nancy Willard, M.S., J.D.
Windows Vista Team Blog
Tuesday, February 20, 2007
Free Downloads to Deploy and Manage Windows Vista
One of the things we’ve done differently with the release of Windows Vista is made it a priority to provide IT professionals with the tools and guidance they need to successfully deploy the new desktop OS as easily, quickly, and with as little cost as possible. Today we are happy to announce that the full set of tools we’ve created for business to deploy Windows Vista are available for free download. Many businesses have been using beta versions of these tools, and now they are all ready for production use:
List of tools and downloads available here
by certifiedbug on February 21, 2007
in Security
Commissioner Jon Leibowitz was the sole dissenter in the FTC’s 4-1 decision against DirectRevenue and issued a separate statement.
“In this consent agreement, Commission staff obtained strong injunctive relief that will put an end to practices that allowed DirectRevenue to foist unwanted software on untold millions of consumers. But the $1.5 million in monetary relief that the Commission obtained as part of the consent agreement is a disappointment because it apparently leaves DirectRevenue’s owners lining their pockets with more than $20 million from a business model based on deceit.”
“I would rather go to trial and risk losing than settle for a compromise that makes an FTC action just a cost of doing business.”
Dissenting Statement of Commissioner Jon Leibowitz. (PDF)
The settlement statement (PDF) notes that it “does not constitute an admission that the law has been violated as alleged.”
No news there, DirectRevenue has a long history of denial and blaming affiliates.
Direct Revenue’s Dirty Documents by Ben Edelman
Federal Trade Commission
February 16, 2007
Will Give Up $1.5 Million in Ill-Gotten Gains for Unfair and Deceptive Adware Downloads
DirectRevenue LLC, a large adware distributor, and four of its principals have agreed to settle Federal Trade Commission charges that they used unfair and deceptive methods to download adware onto consumers’ computers and then obstruct them from removing it, in violation of federal law. The settlement bars future downloads of DirectRevenue’s adware without consumers’ express consent and requires DirectRevenue to provide a reasonable and effective way for consumers to locate and remove the adware from their computers. The settlement also require DirectRevenue to give up $1.5 million in ill-gotten gains.
DirectRevenue’s adware infected computers worldwide,” said FTC Chairman Deborah Platt Majoras. “The FTC settlement brings unauthorized software downloads to a halt and stops DirectRevenue from sending pop-up ads to computers affected by prior unlawful downloads.
Full Article
by certifiedbug on February 18, 2007
in Security
Upon being alerted, Microsoft responded swiftly to address the problem.
Spyware Sucks Article complete with screenshots.
by certifiedbug on February 18, 2007
in News
Hard to imagine this story getting any stranger.
One of the jurists on the Amero case wrote to Steve Bass at Computer World under the handle of ConnYankee1951.
Apparently Bass has confirmed the emailer was on the jury that convicted Julie Amero, which is a scary thought after reading the rational for conviction.
Read that article and comments here
Followed by an article written after Bass received an email from Detective Mark Lounsbury; the crime prevention officer with the Norwich Police Department who testified for the prosecution.
The emails are flying around, Region 19 BOE Gazette was tipped off to this story:
WTNH news
(Norwich-AP, Dec. 20, 2001 12:40 PM) A Norwich police detective has admitted to drinking beer while driving a minor around the city on a sting targeting alcohol sales to underage drinkers.
That’s according to a report in today’s Day of New London newspaper.
Detective Mark Lounsbury, who drove the police van used in the undercover sting operation on November 30th made the admission last week to Deputy Chief Warren Mocek, the newspaper reported.
Mocek is overseeing an investigation into a misconduct complaint against Lounsbury and Lieutenant James Daigle.
A 20-year-old woman claims Daigle photographed her topless while she was working for the department in the same sting operation.
What a cast of characters.
by certifiedbug on February 15, 2007
in News
Comments I have read on the web remind me of The Salem Witchcraft Trials history, circa 1692.
I can understand a teacher being reprimanded for web browsing or checking personal email while in class, but Amero faces 40 years in prison for allegedly exposing kids to porn. Many IT Security experts believe she is innocent.
One juror was quoted at boston.com (The Boston Globe), that all Amero had to do was throw a coat over the computer or…. Would that be before, or after she called the fire truck.
Since Paperghost linked at Vitalsecurity to the article at boston.com, it appears, as of writing, one now has to register and login to see it.
Amero has stated that before class started, she had been told not to turn off the machine and the fact that she did not, has been discussed ad nauseam.