technical solutions and commentary

It’s only been a little over one month since Apple released the Mac OS X 10.5.3 update, but today (June 30, 2008) they released the 10.5.4 combo update to the web. According to Apple’s Web Site, this update includes general OS improvements that enhance the stability, compatibility, and security of the Mac OS. More specifically updates are included for:

• Mac OS general capabilities
• AirPort
• iCal
• Safari
• Spaces and Expose’

get the details about this update from: http://support.apple.com/kb/HT1994

download the 561MB update directly from Apples support downloads page: http://www.apple.com/support/downloads/macosx1054comboupdate.html

after receiving and loading my new Lenovo ThinkPad T61p with Windows Vista 64-bit, I would get random Blue Screens (BSOD) and the machine would shut down a few time in the first week of use. These blue screens started to occur more often this last week, especially after I installed my podcast receiver, and started multiple large file downloads.

So to figure out what was causing this, I installed the "Diagnostic and Recovery Toolkit" which is now part of the Microsoft Desktop Optimization PAck (MDOP). Once this was installed, I figured out that the NETw4v64.sys file was causing a memory error resulting in the BSOD. Using this information, I searched on the file name and blue screen. What I found was that all kind of people where having the same problem with the Intel 3945 wireless driver when running Windows Vista 64-bit. The problem seemed to affect any type of machine that had this combination of things, no matter who the manufacturer was. I verified the issue was the wireless card driver by disabling the wireless card with the hard switch on my laptop and ran it without blue screening for hours. The I enabled the card, started a large file download, and bang! in a minute or two I was staring at a BSOD.

the first thing I did was to download and install the latest wireless driver directly from Intel hoping that they had fixed the problem. So after installing the new driver, I started a new download and… BSOD. I also tried to install the 32-but driver for Vista but it wouldn’t allow the 32-bit driver install. I also tried to install older x64 drivers and nothing worked.

So, to fix this problem of the BSOD from this Intel driver, I did an "XP" fix on Vista. I downloaded the driver for the Intel 3945 Wireless card from the Lenovo site for Windows XP 64-bit. I delete the current Intel drover for Vista from Device Manager (Accessable in Control Panel) - including the option to delete the driver from the system. After deleting the driver, I had to install the XP driver manually since the Driver installation package for XP will not let you install on vista. To do this yourself, do this:

(to get to the Control Panel: Open the Control Panel / Select "System", then "Advanced system settings" / click on the "Hardware" tab, and on "Device Manager")

1. download and extract the Intel Drivers for the 3945 wireless adaptor for Windows XP 64-bit.
2. Find and expand "Network adapters".
3. Right-click on the ‘wireless network adaptor’, click "Update Driver Software…"
4. Select "Browse my computer for driver software"
5. Click on "Let me pick from a list of device drivers on my computer"
6. Click on "Have disk…"
7. Browse to the folder where the driver was located
8. Select the file wireless driver and press "Open".
9. And then press "OK", and let the installation begin

Microsoft has released the Windows Server 2008 Hyper-V! As promised, Hyper-V was released within 180 days after the RTM if Windows Server 2008. It was released over a month before the deadline set by the Hyper-V team.

Hyper-V can be downloaded from Microsoft today (starting at 12:00PM PST). It will also be pushed out through Windows Update in the next "patch Tuesday" release cycle which is July 8th.

There is more information on the Hyper-V release here:

• Microsoft PressPass announcement: http://www.microsoft.com/presspass/features/2008/jun08/06-26hyperv.mspx
• official hyper-v site: http://www.microsoft.com/hyper-v
• Windows Server Team blog: http://blogs.technet.com/windowsserver/archive/2008/06/25/microsoft-com-powered-by-hyper-v.aspx
• server and tools news blog: http://blogs.technet.com/stbnewsbytes/archive/2008/06/26/it-s-here-windows-server-2008-hyper-v-is-available-for-download.aspx
• virtualization team blog: http://blogs.technet.com/virtualization/archive/2008/06/26/wu-hoo-only-12-days-to-wu.aspx
• Virtualization Solutions Accelerators: http://www.microsoft.com/vsa

Microsoft is aware of a recent escalation in a class of attacks targeting Web sites that use Microsoft ASP and ASP.NET technologies but do not follow best practices for secure Web application development. These SQL injection attacks do not exploit a specific software vulnerability, but instead target Web sites that do not follow secure coding practices for accessing and manipulating data stored in a relational database. When a SQL injection attack succeeds, an attacker can compromise data stored in these databases and possibly execute remote code. Clients browsing to a compromised server could be forwarded unknowingly to malicious sites that may install malware on the client machine.

The purpose of Security Advisory 954462 is to assist Web site administrators in identifying possible issues with their Web application code being susceptible to possible SQL injection attacks and to provide a stopgap solution to mitigate SQL injection attacks against the server while the applications are being fixed.

actions to take

Review Microsoft Security Advisory 954462 for an overview of the issue, details on affected components, mitigating factors, suggested actions, frequently asked questions (FAQ) and links to additional resources.

Microsoft Security Advisory 954462 – Rise in SQL Injection Attacks Exploiting Unverified User Data Input - http://www.microsoft.com/technet/security/advisory/954462.mspx

Additional Resources

• MSRC Blog: http://blogs.technet.com/msrc
• Links to other documentation on SQL Injection and coding best practices
• SQL Server Injection Protection
• Preventing SQL Injections in ASP
• Coding Techniques for protecting against SQL Injection
• Filtering SQL Injection from Classic ASP
• How To: Protect from SQL Injection in ASP .NET
• Security Vulnerability Research & Defense Blog on SQL Injection Attack

Wish there was a simple source downloading for SysInternals utilities that you could get to without having to go through the typical web site? Actually there is at http://live.sysinternals.com, and the utilities are ready to download or use live. If you don’t want to download the utility before using it, just open a command prompt and run the command to the remote server. That’s right, run it from the remote internet server. For example, to run Process Monitor from the remote server:

• Open a Command Prompt as administrator.
• Switch to: “C:\windows\system32>”
• Type (without quotes) “\\live.sysinternals.com\tools\procmon.exe”.

It will take a minute or so for the utility to load into memory on the local machine before it executes. The nice thing is that when you close the application, it’s gone.

Microsoft has released a new Release Candidate for App-v 4.5 (Formerly known as softgrid). The Major highlights include:

• HTTP streaming. We now support streaming virtual applications from an IIS server (v6 or v7). This will provide dramatic performance and scalability improvements for customers with large App-V deployments.
• Re-designed Sequencer.  Simplifies the process and reduces the complexity of creating virtual application packages. There is now a single wizard for creating a new package and advanced settings have been put into an optional screen.
• Dynamic Suite Composition (DSC) for MSI packages allows the flexibility to control virtual application interaction. Administrators wanting to consolidate virtual environments, and enable faster, easier administration, can use the product’s Dynamic Suite Composition, which sequences and manages packages for middleware applications separately from the main application.
• Seamless integration with SCCM 2007 R2. Allows customers to easily deploy virtual applications through the SCCM 2007 R2 infrastructure and scale their deployments.
• Client cache improvements. The maximum size of the client cache has been increased to 1 TB.
• Improved Manageability. Integration and support for VSS writer, MOM Pack, ADM template
• Accessibility. The product is now Section 508 compliant, bringing App-V in line with other Microsoft products.

get more details on what this release will include from the Microsoft App-V Blog. download the RC from Microsoft Connect.

Creating a slipstream image is the process of taking the installation media for an Operating System and injecting a Service Pack into it so you have the Windows Installation Media that is pre-loaded with the Service Pack. This saves the step from having to apply a service pack to a new Windows machine after the OS installation is complete.

There are four basic steps in creating a slipstream Windows Installation:

1. Copying the Windows installation file from the media to your hard drive.
2. Downloading and extracting the Service Pack file to your hard drive.
3. Applying or Slipstreaming the Service Pack file to the Windows installation files.
4. Creating Bootable Media for installing Windows with the Service Pack included. 

Download the PDF instructions on how to Create Slipstream Windows Installation Media.

I recently ran into the issue that users cannot open a file on the network as ‘read-only’ when one user already has the file open. Instead of receiving the option to open the file as ‘read-only’ they get the error: <filename> cannot be found. Check your spelling, or try a different path.

This problem seams to be specific to the user profile.

To fix this:

1. Close Excel
2. Open “RegEdit” from the command prompt from with in the users profile
3. Backup the entire registry
4. Now make these changes from within RegEidt:
   • Expand: HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\
   • Right click the “Excel” registry key and rename it to something like Excel-OLD
   • Exit “RegEdit”
5. Open Excel. You will see “Windows Installer” popup and install something this first time you open Excel.

Tripwire recently released a tool to check the security configurationof VMware ESX Servers called ConfigCheck.

The free utility runs only on Windows and connects remotely to ESX hosts. The tool verifies the ESX configuration against a specific security guideline that VMware published.

Tripwire also has a free document that guides admins in correcting any reported configuration issues.

• Download ConfigCheck here.
• Download the Remediation Guide here.

Tripwire also offers an enterprise version of this tool through BMC.

The second CTP (Community Technology Preview) for Parallel Extensions to .NET 3.5 Framework (June 2008) was released today by Microsoft. Parallel Extensions simplifies development by providing library-based support for introducing concurrence

into applications written with any .NET language. It includes:

• Task Parallel Library (TPL) - which provides imperative data and task parallelism
• Parallel LINQ (PLINQ) - which provides declarative data parallelism
• Coordination Data Structures (CDS) - which provides support for work coordination and managing shared state.

This CTP provides several improvements over the first, including CDS, a new scheduler that is more robust, efficient, and scalable. TPL also exposes new functionality, including methods for continuations. PLINQ now runs on top of TPL, clarifies order-preservation, and provides several new operators.

This download works with the .NET Framework 3.5 as a simple, small-footprint installation that drops a single DLL, documentation, samples, and registers the DLL with Visual Studio 2008.

Download the CTP from the Microsoft download site. See this MSDN Blog Post on the Parallel Programming with .NET Blog for more information.