Microsoft Windows users need to watch out for several flaws in non-Microsoft media players, security experts said.
Apple Computer and RealNetworks have both issued fixes for their Windows software to patch serious security vulnerabilities. Apple released Quicktime 6.5.2 on Wednesday to plug two holes in its Windows media player. On Tuesday RealNetworks advised users of its RealPlayer 10, RealPlayer 10.5 and RealOne Player software to use the "Check for Updates" feature to download the latest patch.
One of the flaws in Apple's Quicktime player affects Mac OS X users as well, but the company patched the problems at the end of September.
"It was fixed for all Mac OS X users at the end of September, and this fixes it for Windows users as well," said an Apple spokesman.
The updated Quicktime program is the latest fix for Apple's computer software. The company typically releases one update a month, and in September published fixes for 15 components of the Mac OS X operating system.
The flaw in RealNetworks' software could allow an attacker to run code on the victim's computer by dressing up a malicious program as a graphics theme, or skin, for the player. The flaw--found independently by two security firms, eEye Digital Security and Next-Generation Security Software--is similar to a problem found in August in Winamp's media-playing software.
eEye previously found a flaw in RealNetwork's software for Windows and Linux that could have allowed a malicious program disguised as a movie to run on the victim's computer.
http://articles.techrepublic.com.com/5100-22_11-5432173.html
Saturday, July 14, 2007
Download: Resource pack for financial management of IT
TechRepublic contributor Peter Hennigan has provided five recent articles offering advice on everything from leasing to IT investments. We’ve gathered those articles into one convenient download and included valuable resources, such as spreadsheets and checklists, to help you put Hennigan’s advice to use immediately.
Download the compilation, and you’ll have the following articles at your fingertips:
* “Portfolio management keeps IT aligned with business strategy”
Hennigan explains how to apply the principles of financial portfolio management to IT investments.
* “Weigh the benefits of leasing decisions to the enterprise and its units”
Understand all the risks that you should factor into the decision to finance IT hardware.
* “Apply this framework to establish a solid acquisition process”
Every acquisition of technology brings some degree of business risk; being organized and prepared is the best way to control it. Learn the key elements to adequately assessing the risks involved, and discover why building a framework is the first step to take.
* “When it comes to IT investment, CIOs need to take the helm”
Hennigan explains that CIOs should couple a take-charge attitude with thoroughly analyzed IT investments to accomplish their major objectives.
* “Targeted communication drives the budget process”
Use these tips from Hennigan to create a smooth budgeting process by preparing thorough financial planning tailored to communicate specifically and effectively to each business unit or stakeholder involved.
* “Follow this model for effective IT cost management”
Hennigan provides a dual view method of cost analysis to allow CIOs to frame cost structures in terms of function and category.
To help you put the advice in these articles to work immediately, we’ve also included the following resource documents:
* IT chart of accounts spreadsheet
* Leasing term checklist
* Checklist for mapping ROI values
* IT cost center budget model spreadsheet
* Template for technical acquisitions
About the author
Hennigan has spent more than 20 years in analytical, sales, financial, and IT roles. Most recently, he has been focused on helping IT organizations optimize their financial management. Prior to launching his consultancy, Technology Contract Solutions, he spent over a decade in senior management positions in the IT department at Liberty Mutual Group.
Download the compilation, and you’ll have the following articles at your fingertips:
* “Portfolio management keeps IT aligned with business strategy”
Hennigan explains how to apply the principles of financial portfolio management to IT investments.
* “Weigh the benefits of leasing decisions to the enterprise and its units”
Understand all the risks that you should factor into the decision to finance IT hardware.
* “Apply this framework to establish a solid acquisition process”
Every acquisition of technology brings some degree of business risk; being organized and prepared is the best way to control it. Learn the key elements to adequately assessing the risks involved, and discover why building a framework is the first step to take.
* “When it comes to IT investment, CIOs need to take the helm”
Hennigan explains that CIOs should couple a take-charge attitude with thoroughly analyzed IT investments to accomplish their major objectives.
* “Targeted communication drives the budget process”
Use these tips from Hennigan to create a smooth budgeting process by preparing thorough financial planning tailored to communicate specifically and effectively to each business unit or stakeholder involved.
* “Follow this model for effective IT cost management”
Hennigan provides a dual view method of cost analysis to allow CIOs to frame cost structures in terms of function and category.
To help you put the advice in these articles to work immediately, we’ve also included the following resource documents:
* IT chart of accounts spreadsheet
* Leasing term checklist
* Checklist for mapping ROI values
* IT cost center budget model spreadsheet
* Template for technical acquisitions
About the author
Hennigan has spent more than 20 years in analytical, sales, financial, and IT roles. Most recently, he has been focused on helping IT organizations optimize their financial management. Prior to launching his consultancy, Technology Contract Solutions, he spent over a decade in senior management positions in the IT department at Liberty Mutual Group.
Lock IT Down: Critical flaw in Windows Media Player could compromise systems
Microsoft has released a new patch for several versions of Windows Media Player, one of the most common programs used for multimedia playback in the business world. The threat, which is rated Critical, is related to the way the software handles downloading of the decorative “skins” for the popular multimedia player.
Details
MS03-017, “Flaw in Windows Media Player Skins Downloading Could Allow Code Execution,” addresses the newly discovered vulnerability in Media Player versions 7.1 and 8. Skins are XML files used to control the graphics that alter the appearance of Media Player. They are merely decorative and the vulnerability isn’t actually related to the skins themselves, which are still considered harmless.
Skin files are normally downloaded to the Temporary Internet Files folder in part to speed loading of the often large graphics files and also because these files are allocated locations dynamically. That makes it impossible (or at least quite difficult) for an attacker to predict where on the computer they are located, reducing the possibility of an attacker remotely accessing the PC.
Applicability
Microsoft Windows Media Player 7.1 and version 8 (the one that comes with Windows XP) are affected. No versions of Media Player 9 are vulnerable to this flaw. Since earlier versions of Media Player are no longer supported, Microsoft did not test them and makes no guarantee that versions prior to 7.1 are free of this vulnerability.
Risk level--critical
Exploiting this flaw could allow an attacker to download arbitrary code to a system and load it into the Startup folder or take other actions.
Mitigating factors
If the target computer has a newer version of Outlook or Outlook Express installed or has applied the recommended security patches to older versions, it will be much more difficult to exploit this threat because users would have to be tricked into opening a malicious e-mail or visit a bogus Web site. See MS03-017 for more details about this. Even if successful, the attacker could run programs only in the security context of the user; therefore, the level of the threat depends on whether the user has administrator or lower-level of privileges.
Fix--install the patch
It’s important to note that there’s nothing actually wrong with any skins themselves, so there is no need to ban them or attempt to locate all of them and remove them from networked or stand-alone PCs in the workplace (or home systems). The problem is in the way Media Player 7.1 and 8 actually download the files.
The patch corrects the faulty way in which Media Player validates the address used in downloading files. Without the patch, a malformed URL could trick the computer into downloading what appears to be a skin but is actually malicious code.
Final word
Many companies are now sending company video clips to users rather than simple e-mails, and Media Player is the preferred tool to play back streaming video on Windows-based computers. Media Player may also be used to play back audio recordings of lectures, speeches, or pep talks from management. So even if your company isn’t making use of Media Player, you should know that many others are.
I probably don’t have to tell you that some bored end users are likely to want to spice up these presentations by downloading some different skins for the player just to personalize their work environment a bit. Therefore, you need to be aware that users could potentially be tricked into downloading malicious files disguised as Windows Media Player skins.
http://articles.techrepublic.com.com/5100-6264_11-5034959.html
Details
MS03-017, “Flaw in Windows Media Player Skins Downloading Could Allow Code Execution,” addresses the newly discovered vulnerability in Media Player versions 7.1 and 8. Skins are XML files used to control the graphics that alter the appearance of Media Player. They are merely decorative and the vulnerability isn’t actually related to the skins themselves, which are still considered harmless.
Skin files are normally downloaded to the Temporary Internet Files folder in part to speed loading of the often large graphics files and also because these files are allocated locations dynamically. That makes it impossible (or at least quite difficult) for an attacker to predict where on the computer they are located, reducing the possibility of an attacker remotely accessing the PC.
Applicability
Microsoft Windows Media Player 7.1 and version 8 (the one that comes with Windows XP) are affected. No versions of Media Player 9 are vulnerable to this flaw. Since earlier versions of Media Player are no longer supported, Microsoft did not test them and makes no guarantee that versions prior to 7.1 are free of this vulnerability.
Risk level--critical
Exploiting this flaw could allow an attacker to download arbitrary code to a system and load it into the Startup folder or take other actions.
Mitigating factors
If the target computer has a newer version of Outlook or Outlook Express installed or has applied the recommended security patches to older versions, it will be much more difficult to exploit this threat because users would have to be tricked into opening a malicious e-mail or visit a bogus Web site. See MS03-017 for more details about this. Even if successful, the attacker could run programs only in the security context of the user; therefore, the level of the threat depends on whether the user has administrator or lower-level of privileges.
Fix--install the patch
It’s important to note that there’s nothing actually wrong with any skins themselves, so there is no need to ban them or attempt to locate all of them and remove them from networked or stand-alone PCs in the workplace (or home systems). The problem is in the way Media Player 7.1 and 8 actually download the files.
The patch corrects the faulty way in which Media Player validates the address used in downloading files. Without the patch, a malformed URL could trick the computer into downloading what appears to be a skin but is actually malicious code.
Final word
Many companies are now sending company video clips to users rather than simple e-mails, and Media Player is the preferred tool to play back streaming video on Windows-based computers. Media Player may also be used to play back audio recordings of lectures, speeches, or pep talks from management. So even if your company isn’t making use of Media Player, you should know that many others are.
I probably don’t have to tell you that some bored end users are likely to want to spice up these presentations by downloading some different skins for the player just to personalize their work environment a bit. Therefore, you need to be aware that users could potentially be tricked into downloading malicious files disguised as Windows Media Player skins.
http://articles.techrepublic.com.com/5100-6264_11-5034959.html
Friday, July 13, 2007
Merge your CD playlist from one Windows 2000 Pro machine to another
The ability to share and move your music database eliminates the need to re-enter or re-download the track list for each CD in your collection. The CD Player in Windows 2000 Professional uses an Access database located in Documents and Settings\user\Application Data\Microsoft\CD Player\DeluxeCD.mdb to store the CD data.
Moving or copying the DeluxeCD.mdb database from one computer to another brings all of the CD titles and tracks from the source computer to the destination computer; but any track listings already on the destination computer are lost when you replace the database file. If Microsoft Access is on your system, however, you can create update queries to merge together the two databases so you don't lose any existing titles. Here's how.
- Close the CD Player and open the Documents and Settings\user\Application Data\Microsoft\CD Player folder on the destination computer.
- Rename the file DeluxeCD.mdb to Old.mdb.
- Copy the DeluxeCD.mdb file from the source computer to the Documents and Settings\user\Application Data\Microsoft\CD Player folder on the destination computer, retaining the original name.
- Open Old.mdb in Access and click Queries.
- Double-click Create Query By Using Wizard to start the Query Wizard.
- Select Table: Titles from the Tables/Queries drop-down list, add all available fields to the Selected Fields list, and click Finish to open the query.
- Choose View | Design View to switch the query to design view.
- Choose Query | Append Query to open the Append dialog box.
- Select Titles from the Table Name drop-down list and then select the Another Database option.
- Click Browse and locate and select the DeluxeCD.mdb database file you copied previously.
- Click OK twice to close the file selection and the Append dialog boxes.
Repeat this process to add one query for each of the other tables to perform an update query from one table in the Old.mdb database to the corresponding table in the DeluxeCD.mdb database, such as Tracks to Tracks, Titles to Titles, and so on.
When you finish creating all the queries, run each one to merge the records in the Old.mdb database to the DeluxeCD.mdb database. The next time you open CD Player, you'll see the track lists from each database.
http://articles.techrepublic.com.com/5100-10877_11-6114342.html
Thursday, July 12, 2007
Review: Gadget Of The Month
This has got to be the wildest, craziest gadget any man could want. AskMen.com staff believe that the new Oracle CD Turntable is the ultimate in audio entertainment. It contains has a magnetic clamp that holds the disc flat resulting in a ultra smooth rotation.
The Oracle CD Player's main chassis assembly is suspended and isolated from room vibrations using four suspension towers that have shock absorbers inside. Each suspension tower assembly combines twelve different components.
oracle cd of the future The suspension system is a highly sophisticated device combining seven different mechanical filters, all working together to effectively control unwanted vibrations. The result is clear sound that music lovers everywhere can appreciate. It's no wonder that Oracle won the Innovation Award at this year's International Consumer Electronics Show.
AskMen.com gives this product two enthusiastic thumbs up. The only setback, of course, is Oracle's asking price: a hefty $8,000.
http://www.askmen.com/toys/mrtech/tech2.html
The Oracle CD Player's main chassis assembly is suspended and isolated from room vibrations using four suspension towers that have shock absorbers inside. Each suspension tower assembly combines twelve different components.
oracle cd of the future The suspension system is a highly sophisticated device combining seven different mechanical filters, all working together to effectively control unwanted vibrations. The result is clear sound that music lovers everywhere can appreciate. It's no wonder that Oracle won the Innovation Award at this year's International Consumer Electronics Show.
AskMen.com gives this product two enthusiastic thumbs up. The only setback, of course, is Oracle's asking price: a hefty $8,000.
http://www.askmen.com/toys/mrtech/tech2.html
Apple licenses game player: Bandai to sell Pippin CD-ROM platform.
No, this isn't a misprint or an April Fools' story. Apple has announced that it has completed and will be licensing Pippin, a CD-ROM game platform similar to 3DO and Phillips' CD-I. According to Apple, Pippin is based on the Mac OS and uses a PowerPC 603 chip and a 4X CD-ROM drive; Pippin titles will run without modification on Macintosh systems, and Mac CD-ROM titles will require only minor tweaks to run on Pippin systems. The company also said that users would be able to play MPEG-compressed movies with a third-party expansion card to be announced.
In some ways this ...
http://www.highbeam.com/doc/1G1-16603139.html
Dial Up the Web With a Cellphone
Q. How do I use my cellphone as a modem?
A. Many wireless phones can double as modems so you can link your notebook to the Web when you can’t find a direct or wireless Internet connection. But the method for making them work varies with the type of phone you have and your service. You can usually find specific information in the support area of your carrier’s Web site.
In many cases, you just need your laptop, any required connection software and a data plan from your phone carrier. You also need a way to connect the phone to the computer, like a U.S.B. data cable or Bluetooth link. If your phone didn’t come with a U.S.B. cable, sites like www.3gcables.com may have what you need. When you connect the phone to the computer, you may get a message asking for drivers. If your phone did not come with a CD of drivers and additional software, you can probably find the drivers for your model with a quick Web search.
Some Mac OS X machines can automatically recognize the phone as a modem. There are illustrated guides for setting up the phone as a modem for a Mac with a Bluetooth connection; the page at homepage.mac.com/jrc/contrib/tzones/ has an example.
It is easier with Sprint and Verizon, which use a network standard called C.D.M.A., because they offer their own connection kits. Once you get any required software from your carrier installed and the computer recognizes your phone when you connect it, you usually just click the software’s Go or Connect button to take the laptop online through the phone connection.
AT&T and T-Mobile, which use the G.S.M. standard for their networks, are not quite as straightforward. You might need to set up the phone as a modem by creating a new dial-up connection, just as you would set up a dial-up modem on a PC at home. Ask the company for the number to use for dialing into its data network and put that number in the modem’s dial-up settings. Most carriers have help on their Web site; T-Mobile’s, for example, is tinyurl.com/28j2xr.
For Added Security,
A Finger’s Touch
Q. My laptop comes with a fingerprint reader as an extra layer of security. If I set it up for the swipe of a finger, but then later cut or injure that same finger, will I be locked out of my own laptop?
A. Biometrics, or personal identification based on unique characteristics like face recognition, fingerprint reading or iris scanning, has moved out of the realm of science fiction and into everyday life for some people. Some laptops, like some of Lenovo’s ThinkPads and a few Hewlett-Packard models, come with fingerprint sensors embedded next to the keyboard.
As part of the setup process for a fingerprint scanner, a program guides you through “enrolling” a finger by running it over the sensor so it can be identified by the software. Depending on the sensitivity of the software and how many aspects of your fingerprint it uses for identification, a cut on your finger may not affect your ability to log in.
As a safety measure, many fingerprint identification programs ask you to enroll multiple fingers during the setup so you can use another digit if necessary. Some systems also have a password that can override the fingerprint sensor.
Fingerprint sensors can take some getting used to, as swiping your finger too quickly or having wet hands may affect its ability to read your fingerprint. Lenovo’s Web site explains some of the things you can do with a fingerprint reader at tinyurl.com/yatjtg.
TIP OF THE WEEK If you listen to music on your computer as you browse the Web, a handy browser plug-in called FoxyTunes can save you time clicking around for your media player every time you want to pause, skip or replay a song. FoxyTunes, a free download for Firefox and Internet Explorer, works with more than 30 media players and gives you track information and playback controls right in the browser’s status bar or toolbar. It’s available at www.foxytunes.com/firefox/download.
http://www.nytimes.com/2007/07/12/technology/circuits/12askk.html?_r=1&oref=slogin
A. Many wireless phones can double as modems so you can link your notebook to the Web when you can’t find a direct or wireless Internet connection. But the method for making them work varies with the type of phone you have and your service. You can usually find specific information in the support area of your carrier’s Web site.
In many cases, you just need your laptop, any required connection software and a data plan from your phone carrier. You also need a way to connect the phone to the computer, like a U.S.B. data cable or Bluetooth link. If your phone didn’t come with a U.S.B. cable, sites like www.3gcables.com may have what you need. When you connect the phone to the computer, you may get a message asking for drivers. If your phone did not come with a CD of drivers and additional software, you can probably find the drivers for your model with a quick Web search.
Some Mac OS X machines can automatically recognize the phone as a modem. There are illustrated guides for setting up the phone as a modem for a Mac with a Bluetooth connection; the page at homepage.mac.com/jrc/contrib/tzones/ has an example.
It is easier with Sprint and Verizon, which use a network standard called C.D.M.A., because they offer their own connection kits. Once you get any required software from your carrier installed and the computer recognizes your phone when you connect it, you usually just click the software’s Go or Connect button to take the laptop online through the phone connection.
AT&T and T-Mobile, which use the G.S.M. standard for their networks, are not quite as straightforward. You might need to set up the phone as a modem by creating a new dial-up connection, just as you would set up a dial-up modem on a PC at home. Ask the company for the number to use for dialing into its data network and put that number in the modem’s dial-up settings. Most carriers have help on their Web site; T-Mobile’s, for example, is tinyurl.com/28j2xr.
For Added Security,
A Finger’s Touch
Q. My laptop comes with a fingerprint reader as an extra layer of security. If I set it up for the swipe of a finger, but then later cut or injure that same finger, will I be locked out of my own laptop?
A. Biometrics, or personal identification based on unique characteristics like face recognition, fingerprint reading or iris scanning, has moved out of the realm of science fiction and into everyday life for some people. Some laptops, like some of Lenovo’s ThinkPads and a few Hewlett-Packard models, come with fingerprint sensors embedded next to the keyboard.
As part of the setup process for a fingerprint scanner, a program guides you through “enrolling” a finger by running it over the sensor so it can be identified by the software. Depending on the sensitivity of the software and how many aspects of your fingerprint it uses for identification, a cut on your finger may not affect your ability to log in.
As a safety measure, many fingerprint identification programs ask you to enroll multiple fingers during the setup so you can use another digit if necessary. Some systems also have a password that can override the fingerprint sensor.
Fingerprint sensors can take some getting used to, as swiping your finger too quickly or having wet hands may affect its ability to read your fingerprint. Lenovo’s Web site explains some of the things you can do with a fingerprint reader at tinyurl.com/yatjtg.
TIP OF THE WEEK If you listen to music on your computer as you browse the Web, a handy browser plug-in called FoxyTunes can save you time clicking around for your media player every time you want to pause, skip or replay a song. FoxyTunes, a free download for Firefox and Internet Explorer, works with more than 30 media players and gives you track information and playback controls right in the browser’s status bar or toolbar. It’s available at www.foxytunes.com/firefox/download.
http://www.nytimes.com/2007/07/12/technology/circuits/12askk.html?_r=1&oref=slogin
Subscribe to:
Posts (Atom)