Archive for July, 2009

07.28.09

Restarting Exchange 2007 Services

Posted in OS at 12:31 pm by webmaster

There are now 16 services shipped in a 1 server install of Exchange 2007 SP1 on Windows 2008 SP2.

 Exchange 2007 SP1 Default Services

By default 13 of those are running.

 

This site has a good introduction on understanding the various Exchange service dependencies.

 

07.13.09

Second ActiveX/Vulnerability

Posted in OS at 6:01 pm by webmaster

There is a new security vulnerability that exists in ActiveX (Microsoft Office Web Components) that is actively being exploited.   This advisory was first made available on July 13.  This is the second of two exploits in ActiveX so far for the month of July.  This vulnerability can affect Windows XP users with Office 2003 installed.  Vista/Windows 7 and Office 2007 are not known to be affected in tyheir default install configurations

What makes this vulnerability/exploit important is that the users PC can be infected by simply clicking on a link in an email, messenger or on a web page (dependent on ActiveX settings in the browser.)  This can allow a unauthorized user to use your PC for uses that you do not authorize (remote code execution)

  • There is a “workaround” that you may want to install to prevent the exploit from occurring
    • Please note it removes browser functionality but as far as I know most users do not use this functionality.  This will have to be taken on a case by case basis.
    • If you are interested in deploying the workaround there is one listed in the “workaround” section http://support.microsoft.com/kb/973472  Click Enable Workaround - Fix Me
  • No permanent fix is available at this time
  • Computerworld, Microsoft Security Blog

ActiveX Vulnerability/Exploit

Posted in OS, Vulnerability at 5:33 pm by webmaster

There is a security vulnerability that exists in ActiveX that is actively being exploited.   This advisory was first made avaialble in early July.  This is the first of two exploits in ActiveX so far for the month of July.

What makes this vulnerability/exploit important is that the users PC can be infected by simply clicking on a link in an email or on a web page (dependent on ActiveX settings in the browser.)  This can allow a unauthorized user to use your PC for uses that you do not authorize (remote code execution)

  • There is a “workaround” that you may want to install to prevent the exploit from occurring
    • Please note it removes browser functionality but as far as I know most users do not use this functionality.  This will have to be taken on a case by case basis.
    • If you are interested in deploying the workaround there is one listed in the “workaround” section http://www.microsoft.com/technet/security/advisory/972890.mspx
  • A fix was released for this vulnerability on Tuesday July 14, 2009
  • Symantec had this in their sinatures since July 5. Sonicwall also included IPS signatures around that time.