(Approx. 1,030 words)

Microsoft patches still another patch
By Bob de Violini, a member of the Channel Islands PCUG, CA
www.cipcug.org
rjddev(at)gmail.com

Obtained from APCUG with the author's permission for publication by APCUG member groups.

From the once is not enough department, Microsoft has, again, patched a patch. This time, it involves patch number MS07-069, which is a cumulative security update for Internet Explorer 6 installed on Windows XP Service Pack 2 only. Apparently the initial patch released on December’s patch Tuesday caused computers to experience an unexpected crash or hang upon launching Internet Explorer. If you, like I, have updating set to notify but not download and install, or if you visit the Windows Update
site on your own once a month instead of using Auto Update, then by all means please go to the Windows Update site and grab the fix as soon as you can. The fix doesn’t require a reboot; it just makes a minor registry entry to prevent IE6 from crashing again.

Internet Explorer and G-mail 
Rolling right along, there was some debate during December with regards to a “vulnerability” that exists when visiting Google’s web-based e-mail site, Gmail, with Internet Explorer. When the “bug” was pointed out to the computer industry media, both Microsoft and Google denied the root of the problem was with theirs. Apparently, an investigator has claimed that IE improperly stores files in its cache and that the scripting of Gmail allows this to be exploited, which would allow someone to steal any user names and passwords for Gmail that have been entered since the last time the IE cache was purged. The simple way around this is to use a browser besides IE when you visit Gmail or, if you must use IE for checking your mail with Gmail, first purge the cache and all cookies and then log in to the site. To purge IE’s cache, inside IE go to the Tools drop down menu and select Internet Options. Now, in the middle of the Internet Options box, click the Delete Cookies button and click OK in the box that pops up. Next, click the Delete Files button and click OK in the box that pops up. Now click the OK button at the bottom of the Internet Options box, and you’re all set. There has been no other news about this issue, so using another browser or purging IE’s cache is the only solution for now. By the way, the biggest risk for this behavior appears to be if you’re sharing computer access such as that which is available at a public library or a shopping mall where you pay for a few minutes of high-speed Internet access.

Critical Updates for QuickTime
For those of you who are fond of using Apple’s QuickTime media player, there have been a couple of updates released in December to fix a few critical security vulnerabilities. If you only updated QuickTime once during that timeframe, you might want to visit Apple’s site to get the latest update. The most recent version of the player (without the I Tunes add-on) is 7.3.1.70. While you’re at the Apple site, you might want
to download and install the Apple Software updater, which makes it very easy to keep QuickTime updated. Just click on it and watch it do its thing.

HP computer vulnerabilities
For those of you who have Hewlett Packard laptops and desktops, there is a vulnerability in HP’s Software Update software. This vulnerability can allow an attacker to turn your computer into a useless collection of metal and plastic that’s completely unbootable. HP rushed out a fix in around four days, and it’s now available for your download. Computer security experts suggest installing it even if you don’t use the HP Software Update function at all, as just having the software on your computer makes it vulnerable. One catch — you have to run the vulnerable software to get the update
to fix it. HP has had no comment about it at all, and there’s no mention of it on its Web site. Please keep in mind that the HP Software Update software is completely separate from, and unrelated to, any other updating software that is installed on the computer like Windows Update or Microsoft Update. 

Windows Vista change
Shifting gears toward Vista, Microsoft has announced that, effective with Service Pack 1 for Vista due out in the first quarter of this year, those with cracked or counterfeit copies of Vista will no longer have their machines made to run in reduced functionality mode by the Windows Genuine Advantage validation tool. Instead, they’ll just get nagged about once an hour to get a legal copy of Vista on their machines. Microsoft has said that this new stance is in response to customer and partner requests. Time will tell just how well this new policy goes over.

Adobe Flash patch coming
This next item pertains to a good number of folks reading this and deals with an application that runs within the vast majority of the Internet browsers in use that’s called Flash. This application enables you to see animated ads and other “mini movies” within your browser. There have been a couple of very widely publicized bugs in it, one of
which has been patched. The other one is under investigation by Adobe, which has pledged a fix early this year. The way I read the security bulletin, it will probably be out by the end of January, and may already be out by the time you’re reading this at home.
As of this writing, the latest version of the Adobe Flash player is 9.0.115.0. This version number will, no doubt, change as soon as the second bug is patched. The Adobe security bulletin about the second patch can be found at http://tinyurl.com/2kktqs. When you get there, you’ll find it on the technical side of things, but there’s a section titled
“Preventative Measures for End-Users” which spells things out in plain English for the rest of us.

This article has been provided to APCUG by the author solely for publication by APCUG member groups. All other uses require the permission of the author (see e-mail address above).