ReactOS - Home
This... Is going to be interesting...
Thursday, June 24, 2004
Monday, June 21, 2004
WTNH.com - Governor Rowland announces resignation effective July 1
And so it ends...
Now what Connecticut?
MSNBC coverage
And so it ends...
Now what Connecticut?
MSNBC coverage
Wednesday, June 16, 2004
Tuesday, June 15, 2004
G4techTV Canada announces Canadian-produced Call for Help with award-winning U.S. technophile Leo Laporte
It's totally official!
Leo's back On The Air...!
It's totally official!
Leo's back On The Air...!
Saturday, June 12, 2004
Cyber Alert:
Technical Cyber Security Alert TA04-163A
Cross-Domain Redirect Vulnerability in Internet Explorer
Original release date: June 11, 2004
Last revised: --
Source: US-CERT
Systems Affected
Microsoft Windows systems
Overview
A cross-domain vulnerability in Internet Explorer (IE) could allow an
attacker to execute arbitrary code with the privileges of the user
running IE.
I. Description
There is a cross-domain vulnerability in the way IE determines the
security zone of a browser frame that is opened in one domain then
redirected by a web server to a different domain. A complex set of
conditions is involved, including a delayed HTTP response (3xx status
code) to change the content of the frame to the new domain.
Vulnerability Note VU#713878 describes this vulnerability in more
technical detail and will be updated as further information becomes
available.
Other programs that host the WebBrowser ActiveX control or use the
MSHTML rendering engine, such as Outlook and Outlook Express, may also
be affected.
This issue has been assigned CVE CAN-2004-0549.
II. Impact
By convincing a victim to view an HTML document (web page, HTML
email), an attacker could execute script in a different security
domain than the one containing the attacker's document. By causing
script to be run in the Local Machine Zone, the attacker could execute
arbitrary code with the privileges of the user running IE.
Publicly available exploit code exists for this vulnerability, and
US-CERT has monitored incident reports that indicate that this
vulnerability is being actively exploited.
III. Solution
Until a complete solution is available from Microsoft, consider the
following workarounds.
Disable Active scripting and ActiveX controls
Disabling Active scripting and ActiveX controls in the Internet Zone
(or any zone used by an attacker) appears to prevent exploitation of
this vulnerability. Disabling Active scripting and ActiveX controls in
the Local Machine Zone will prevent widely used payload delivery
techniques from functioning. Instructions for disabling Active
scripting in the Internet Zone can be found in the Malicious Web
Scripts FAQ. See Microsoft Knowledge Base Article 833633 for
information about securing the Local Machine Zone. Also, Service Pack
2 for Windows XP (currently at RC1) includes these and other security
enhancements for IE.
Do not follow unsolicited links
Do not click on unsolicited URLs received in email, instant messages,
web forums, or internet relay chat (IRC) channels. While this is
generally good security practice, following this behavior will not
prevent exploitation of this vulnerability in all cases.
Maintain updated anti-virus software
Anti-virus software with updated virus definitions may identify and
prevent some exploit attempts. Variations of exploits or attack
vectors may not be detected. Do not rely solely on anti-virus software
to defend against this vulnerability. More information about viruses
and anti-virus vendors is available on the US-CERT Computer Virus
Resources page.
Appendix B. References
* Vulnerability Note VU#713878-
* Malicious Web Scripts FAQ -
* Computer Virus Resources -
* CVE CAN-2004-0549 -
* Microsoft Knowledge Base Article 833633 -
* Windows XP Service Pack 2 RC1 -
* Increase Your Browsing and E-Mail Safety -
* Working with Internet Explorer 6 Security Settings -
_________________________________________________________________
Public incidents related to this vulnerability were reported by Rafel
Ivgi. Thanks to Jelmer for further research and analysis.
_________________________________________________________________
Feedback can be directed to the author: Art Manion.
Send mail to.
Please include the Subject line "TA04-163A Feedback VU#713878".
_________________________________________________________________
Copyright 2004 Carnegie Mellon University.
Terms of use:
_________________________________________________________________
The most recent version of this document can be found at:
_________________________________________________________________
Revision History
June 11, 2004: Initial release
Technical Cyber Security Alert TA04-163A
Cross-Domain Redirect Vulnerability in Internet Explorer
Original release date: June 11, 2004
Last revised: --
Source: US-CERT
Systems Affected
Microsoft Windows systems
Overview
A cross-domain vulnerability in Internet Explorer (IE) could allow an
attacker to execute arbitrary code with the privileges of the user
running IE.
I. Description
There is a cross-domain vulnerability in the way IE determines the
security zone of a browser frame that is opened in one domain then
redirected by a web server to a different domain. A complex set of
conditions is involved, including a delayed HTTP response (3xx status
code) to change the content of the frame to the new domain.
Vulnerability Note VU#713878 describes this vulnerability in more
technical detail and will be updated as further information becomes
available.
Other programs that host the WebBrowser ActiveX control or use the
MSHTML rendering engine, such as Outlook and Outlook Express, may also
be affected.
This issue has been assigned CVE CAN-2004-0549.
II. Impact
By convincing a victim to view an HTML document (web page, HTML
email), an attacker could execute script in a different security
domain than the one containing the attacker's document. By causing
script to be run in the Local Machine Zone, the attacker could execute
arbitrary code with the privileges of the user running IE.
Publicly available exploit code exists for this vulnerability, and
US-CERT has monitored incident reports that indicate that this
vulnerability is being actively exploited.
III. Solution
Until a complete solution is available from Microsoft, consider the
following workarounds.
Disable Active scripting and ActiveX controls
Disabling Active scripting and ActiveX controls in the Internet Zone
(or any zone used by an attacker) appears to prevent exploitation of
this vulnerability. Disabling Active scripting and ActiveX controls in
the Local Machine Zone will prevent widely used payload delivery
techniques from functioning. Instructions for disabling Active
scripting in the Internet Zone can be found in the Malicious Web
Scripts FAQ. See Microsoft Knowledge Base Article 833633 for
information about securing the Local Machine Zone. Also, Service Pack
2 for Windows XP (currently at RC1) includes these and other security
enhancements for IE.
Do not follow unsolicited links
Do not click on unsolicited URLs received in email, instant messages,
web forums, or internet relay chat (IRC) channels. While this is
generally good security practice, following this behavior will not
prevent exploitation of this vulnerability in all cases.
Maintain updated anti-virus software
Anti-virus software with updated virus definitions may identify and
prevent some exploit attempts. Variations of exploits or attack
vectors may not be detected. Do not rely solely on anti-virus software
to defend against this vulnerability. More information about viruses
and anti-virus vendors is available on the US-CERT Computer Virus
Resources page.
Appendix B. References
* Vulnerability Note VU#713878-
* Malicious Web Scripts FAQ -
* Computer Virus Resources -
* CVE CAN-2004-0549 -
* Microsoft Knowledge Base Article 833633 -
* Windows XP Service Pack 2 RC1 -
* Increase Your Browsing and E-Mail Safety -
* Working with Internet Explorer 6 Security Settings -
_________________________________________________________________
Public incidents related to this vulnerability were reported by Rafel
Ivgi. Thanks to Jelmer for further research and analysis.
_________________________________________________________________
Feedback can be directed to the author: Art Manion.
Send mail to
Please include the Subject line "TA04-163A Feedback VU#713878".
_________________________________________________________________
Copyright 2004 Carnegie Mellon University.
Terms of use:
_________________________________________________________________
The most recent version of this document can be found at:
_________________________________________________________________
Revision History
June 11, 2004: Initial release
G4techTV.ca | G4techTV Canada Brings Leo Back!
WooHoo!
Now... how do I get me some of that Canadian Programming....
WooHoo!
Now... how do I get me some of that Canadian Programming....
Ham's!
Radio amateur's!
Are you like me?
Love new technology?
(low on cash?)
Would love to operate DX on the HF bands but can't afford a rig? (i can't....)
Have I got the solution for you!
Ok - so it's not new - but it's new to ME... (which is odd.....)
Echo Link
Combining internet technology (and VoIP) and our broad radio spectrum...
Go read it - download the app and use it...
Look for me - N1GWF - and we can QSO!
TTYL
Radio amateur's!
Are you like me?
Love new technology?
(low on cash?)
Would love to operate DX on the HF bands but can't afford a rig? (i can't....)
Have I got the solution for you!
Ok - so it's not new - but it's new to ME... (which is odd.....)
Echo Link
Combining internet technology (and VoIP) and our broad radio spectrum...
Go read it - download the app and use it...
Look for me - N1GWF - and we can QSO!
TTYL
Tuesday, June 08, 2004
For your reading enjoyment: the latest Cyber Security Bulletin:
This will be my new feature... I'll post these as they come in.. as an FYI...
Technical Cyber Security Alert TA04-160A
SQL Injection Vulnerabilities in Oracle E-Business Suite
Original release date: June 8, 2004
Last revised: --
Source: US-CERT
Systems Affected
* Oracle Applications 11.0 (all releases)
* Oracle E-Business Suite 11i, 11.5.1 through 11.5.8
Overview
A vulnerability in the Oracle's E-Business Suite allows a remote
attacker to execute arbitrary script on a vulnerable database system.
Exploitation may lead to compromise of the database application, data
integrity, or underlying operating system.
I. Description
Oracle E-Business Suite is a set of applications and modules that
enables an organization to manage customer interactions, deliver
services, manufacture products, ship orders, collect payments, and
other tasks using a single database model.
According to the Oracle Security Alert 67, Oracle Applications 11.0
(all releases) and Oracle E-Business Suite Release 11i, 11.5.1 through
11.5.8 are vulnerable to SQL injection vulnerabilities. Oracle
E-Business Suite Release 11.5.9 and later are not vulnerable. This
vulnerability is not platform specific. Integrigy Corporation has also
released an alert about these vulnerabilities.
Note that no authentication mechanisms of Oracle E-Business Suite will
mitigate exploitation of the attack.
US-CERT is tracking this issue as VU#961579.
II. Impact
An unauthenticated attacker could exploit this vulnerability to
execute arbitrary SQL statements on the vulnerable system with the
privileges of the Oracle server process. In addition to compromising
the integrity of the database information, this may lead to the
compromise of the database application and the underlying operating
system.
III. Solution
Apply Patch or Upgrade
According to the Oracle Security Alert 67, patches and related
information are available from:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocumen
t?p_database_id=NOT&p_id=274375.1
Appendix B. References
* http://otn.oracle.com/deploy/security/pdf/2004alert67.pdf
* http://www.integrigy.com/alerts/OraAppsSQLInjection.htm
* http://www.kb.cert.org/vuls/id/961579
_________________________________________________________________
US-CERT thanks Stephen Kost of Integrigy Corporation for reporting
this problem and for information used to construct this advisory.
_________________________________________________________________
Feedback can be directed to the author: Jason A. Rafail
_________________________________________________________________
The latest version of this document can be found at:
_________________________________________________________________
Copyright 2004 Carnegie Mellon University.
Terms of use:
_________________________________________________________________
Revision History
June 8, 2004: Initial release
This will be my new feature... I'll post these as they come in.. as an FYI...
Technical Cyber Security Alert TA04-160A
SQL Injection Vulnerabilities in Oracle E-Business Suite
Original release date: June 8, 2004
Last revised: --
Source: US-CERT
Systems Affected
* Oracle Applications 11.0 (all releases)
* Oracle E-Business Suite 11i, 11.5.1 through 11.5.8
Overview
A vulnerability in the Oracle's E-Business Suite allows a remote
attacker to execute arbitrary script on a vulnerable database system.
Exploitation may lead to compromise of the database application, data
integrity, or underlying operating system.
I. Description
Oracle E-Business Suite is a set of applications and modules that
enables an organization to manage customer interactions, deliver
services, manufacture products, ship orders, collect payments, and
other tasks using a single database model.
According to the Oracle Security Alert 67, Oracle Applications 11.0
(all releases) and Oracle E-Business Suite Release 11i, 11.5.1 through
11.5.8 are vulnerable to SQL injection vulnerabilities. Oracle
E-Business Suite Release 11.5.9 and later are not vulnerable. This
vulnerability is not platform specific. Integrigy Corporation has also
released an alert about these vulnerabilities.
Note that no authentication mechanisms of Oracle E-Business Suite will
mitigate exploitation of the attack.
US-CERT is tracking this issue as VU#961579.
II. Impact
An unauthenticated attacker could exploit this vulnerability to
execute arbitrary SQL statements on the vulnerable system with the
privileges of the Oracle server process. In addition to compromising
the integrity of the database information, this may lead to the
compromise of the database application and the underlying operating
system.
III. Solution
Apply Patch or Upgrade
According to the Oracle Security Alert 67, patches and related
information are available from:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocumen
t?p_database_id=NOT&p_id=274375.1
Appendix B. References
* http://otn.oracle.com/deploy/security/pdf/2004alert67.pdf
* http://www.integrigy.com/alerts/OraAppsSQLInjection.htm
* http://www.kb.cert.org/vuls/id/961579
_________________________________________________________________
US-CERT thanks Stephen Kost of Integrigy Corporation for reporting
this problem and for information used to construct this advisory.
_________________________________________________________________
Feedback can be directed to the author: Jason A. Rafail
_________________________________________________________________
The latest version of this document can be found at:
_________________________________________________________________
Copyright 2004 Carnegie Mellon University.
Terms of use:
_________________________________________________________________
Revision History
June 8, 2004: Initial release
Saturday, June 05, 2004
Friday, June 04, 2004
IA Revolution - Welcome to the Instant Access Revolution!
This software BOTHERS me...
I have since sent an email to the Tech Support people to get some more info...
Charging $40 for something that can be accomplished for Free?
And then add the MLM feature for distribution... Adds to the fun!
More in a bit.
This software BOTHERS me...
I have since sent an email to the Tech Support people to get some more info...
Charging $40 for something that can be accomplished for Free?
And then add the MLM feature for distribution... Adds to the fun!
More in a bit.
Sunday, May 02, 2004
Tuesday, April 27, 2004
Saturday, April 17, 2004
Whatta day..
Go do yourself a flavor..
Sign it...
You'll enjoy it..
Bring Chris back...! more often!
Go do yourself a flavor..
Sign it...
You'll enjoy it..
Bring Chris back...! more often!
Friday, April 16, 2004
Nice Friday...
3 kids - all in bed...!
cool.
other cool newz:
Yay 4 Leo! - We CAN make a difference!
3 kids - all in bed...!
cool.
other cool newz:
Yay 4 Leo! - We CAN make a difference!
Thursday, April 15, 2004
Monday, April 12, 2004
Subscribe to:
Posts (Atom)