Posts

Posted on

My Twitter Digest for 08/13/2014

Posted on

Flaw in PHP XML Processing Hits Drupal, WordPress. Time To Patch ’em Up.

For the first time, the open-source Drupal and WordPress content management teams have coordinated joint security releases to fix a new vulnerability.

The flaw, first reported by security researcher Nir Goldshlager, is a potential denial-of-service (DoS) issue with PHP’s XML processing module. Drupal and WordPress use the same PHP module, which is why both content management systems are at risk from the same flaw. Drupal is particularly prominent because it is used on U.S. government sites, including WhiteHouse.gov, and WordPress is deployed on more than 60 million sites.

“This bug can be utilized without the aid of any plug-ins, and it functions smoothly on the default installation of WordPress and Drupal,” Goldshlager explained in an advisory (which is running on a WordPress site itself). “Only one machine needed to exploit this vulnerability.”

In an advisory on the drupal.org site, the vulnerability is rated as moderately critical. The Drupal advisory explains that the bug that Goldshlager found is within the PHP XML parser and could trigger CPU and memory exhaustion, in turn causing a DoS condition on the affected site.

via New Flaw Puts Millions of WordPress, Drupal Sites at Risk.

Patches are provided by Drupal 7.31, 6.33 and WordPress 3.9.2.

Posted on

My Twitter Digest for 08/08/2014

Posted on

MSFT Encourages Use of Latest Versions of IE, Urges Upgrades of Commercial Installations

Microsoft recommends enabling automatic updates to ensure an up-to-date computing experience—including the latest version of Internet Explorer—and most consumers use automatic updates today. Commercial customers are encouraged to test and accept updates quickly, especially security updates. Regular updates provide significant benefits, such as decreased security risk and increased reliability, and Windows Update can automatically install updates for Internet Explorer and Windows.

After January 12, 2016, only the most recent version of Internet Explorer available for a supported operating system will receive technical support and security updates. For example, customers using Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 on Windows 7 SP1 should migrate to Internet Explorer 11 to continue receiving security updates and technical support. For more details regarding support timelines on Windows and Windows Embedded, see the Microsoft Support Lifecycle site.

As some commercial customers have standardized on earlier versions of Internet Explorer, Microsoft is introducing new features and resources to help customers upgrade and stay current on the latest browser. Customers should plan for upgrading to modern standards—to benefit from the additional performance, security, and productivity of modern Web apps—but in the short term, backward compatibility with legacy Web apps may be a cost-effective, if temporary, path. Enterprise Mode for Internet Explorer 11, released in April 2014, offers enhanced backward compatibility and enables you to run many legacy Web apps during your transition to modern Web standards.

 

via Stay up-to-date with Internet Explorer – IEBlog – Site Home – MSDN Blogs.

Even though January 2016 may seem like the distant future, it’ll be here before you know it. If your still using apps that rely on IE 8 or 9 you’d better get those upgraded or risk running into issues later.

Posted on

ownCloud 7 Release Adds Many Features, Improves API

The best new feature on ownCloud 7, as far as I’m concerned, is that its new “Server-to-Server Sharing enables users on one ownCloud instance to seamlessly share files with users on a different ownCloud installation without using share links.” So, for example, you can share files with a business partner without a lot of fuss or muss while maintaining your own independent private clouds.
Frank Karlitschek, founder and leader of the ownCloud project, proclaimed that “Server-to-server sharing is a game changer, allowing individuals — and organizations — to more easily share across private clouds, while still maintaining complete control of their data.” I can certainly see companies with close partner ties really liking this feature.

via ownCloud 7 pulls in users and open source developers | ZDNet.

This website uses a Hackadelic PlugIn, Hackadelic Sliding Notes 1.6.5.