New computers come with old software, a situation that, considering the recent slew of critical bug fixes, can be quite dangerous.
To illustrate just how old some of the software is, consider a new Windows XP machine that I got yesterday. The computer, a ThinkCentre A61 tower, was ordered from Lenovo on January 6, 2008. It was delivered to someone on January 16th, exactly who I'll never know. As I wrote about last month, UPS lost my computer. But that's another story.
I've got my new computer routine down pat at this point. First, I run a slew of hardware diagnostics, then I make a disk image backup. Next, I remove the pre-installed software that I don't want, followed by updating the pre-installed software that I'm keeping.
The first update is to Windows itself. I start by manually running Windows Update at www.update.microsoft.com. The Windows Update software is always old. Every new Windows XP computer I've touched required a couple software updates to Windows Update itself before it would even start scanning for missing bug fixes (a.k.a. patches and updates).
The machine was missing 60 fixes to Windows XP. I installed them, re-booted and went back to Windows Update. Experience has shown that Windows Update is far from perfect. Running it a second time often reports a new bug fix that was either missed the first time or is needed because the first go-round installed buggy software. Sure enough, a custom scan shows the machine is missing the .NET Framework version 1.1 Service Pack 1.
After dealing with Windows, I tried the Adobe Flash tester page, which reported that Internet Explorer was using Flash version 7.0.68. This is a really old version of Flash (the latest is 9,0,115,0).
The other popular Adobe product, the Acrobat Reader, was the only reasonably recent software. That said, the pre-installed version, 8.1.0, is missing critical bug fixes that make it too, a security risk.
At this point I turn to the online Secunia Software Inspector to see what other software is missing security patches.
In addition to the ancient version 7 of Flash, the machine also came with the downright pre-historic, and buggy, versions 4 and 6 pre-installed.
Java too, was missing security fixes. Secunia reported that Java was at version 1.5.0_6, which was released about December 2005. The latest version of the 1.5.x family, version 1.5.0_14 is secure, according to Secunia. However, the current version of Java is 1.6.0_4. You can see which version you have at javatester.org.
Lenovo has their own version of Windows Update called ThinkVantage System Update that updates the software they pre-install. It also seems to update other software, but exactly what it targets is not at all clear from the supplied instructions. Just like Windows Update, the first update it finds is to itself.
After self-updating, ThinkVantage System Update finds about a dozen or so software updates, mostly to Lenovo applications. The number would have probably been larger, but I had already un-installed some of the Lenovo software. Interestingly, it offered to install the latest version of the Adobe Flash player, despite the fact that Internet Explorer was already using the latest version at this point, at least according to Adobe's Flash tester page. The updates I chose to accept were 422 megabytes.
Finally, the computer came with Picasa version 2 from Google. The first time I ran Picasa, it wanted to update itself to a newer version.
The hardware in a new computer may be new, but the software never is.
See a summary of all my Defensive Computing postings.
Bug is a dirty word in the software world. After all, it means "mistake" and no one wants to admit they made a mistake. Instead of calling the fix for a mistake by its rightful name, a bug fix, software companies refer to "patches" or "updates". Soft words. Happy words.
The bug itself is called a "hole" or a "vulnerability". Initially, bugs were called "issues" but eventually people caught on. Did you happen to notice that Mitt Romney recently "suspended" his campaign (a soft word), as if he was taking the weekend off, rather than actually stopping (a harsh word).
But getting back to software, below I go over a slew of important bug fixes released in the last few days. I also describe the latest updates to Java and the Flash player even though they weren't released this week. As more and more Windows users get their Windows fixes automatically, the bad guys are naturally going to attack other software on your computer. Thus, it's important to install the fixes described below. This is a Defensive Computing blog after all.
Recent Bug Fixes
Firefox released version 2.0.0.12 on February 7th to fix ten bugs, three of which are considered critical. Firefox runs on Windows, Macs, Linux and more. Mozilla, the company behind Firefox, doesn't say if any of the bugs are specific to an operating system, so all Firefox users should upgrade.
The usual Help -> About displays the currently installed version. You can force Firefox to check for updates with Help -> Check for Updates.
Firefox normally checks for updates often enough that you don't need to be concerned. From what I've seen, looking at website usage statistics, the vast majority of Firefox users are using the latest version. That means most Firefox users have it configured to automatically check for updates. To see how your copy of Firefox is configured, do Tools -> Options -> Advanced -> Updates tab. When updates are found, Firefox can either apply them automatically or to ask you before applying them. All in all, the self-updating of Firefox works great.
The Adobe Acrobat Reader was updated on February 6th to fix security problems on Windows and Macs. Interestingly, Adobe says they support Mac OS X Leopard up through version 10.5.1. That was as of February 7th, but Apple updated Leopard to version 10.5.2 just four days later (see below for more on updates to OS X). Adobe hasn't yet said if this latest update to the Reader works on the latest version of Leopard.
The latest and greatest Acrobat Reader is version 8.1.2. If you are running version 7, the latest edition, 7.0.9, has known bugs but Adobe has not yet issued fixes for. They intend to. According to Adobe Reader 8.1.2 Release Notes the latest version of the Adobe Reader is available on Windows 2000, XP, Vista, 2003 Server, as well as Macs, Linux and Solaris.
In both versions 7 and 8, the usual Help -> About displays the current version and you can check for updates with Help -> Check for updates. Most likely you will find available updates. Version 7 dealt with this well, displaying the all the available updates and letting you pick and chose those to install. Version 8 has, by default, done away with displaying information about each available update. I mention this because there are updates that version 8 users may not want or need.
If you are using version 8, then after checking for updates, click on the "Show details" link before downloading anything. You may also want to click on the "preferences" link to configure self-updates. In terms of security, you don't need the update that installs dictionaries for spell checking for multiple languages. You also don't need the Photoshop Album Starter Edition.
Depending on how your copy of the Adobe Reader is configured, it may notify you of the need to update itself as soon as the program starts up.
According to Adobe, bug fixes are also needed if you are running "Adobe Acrobat Professional, 3D and Standard 8.1.1 and earlier versions". For more see Security update available for Adobe Reader and Acrobat 8 and the Secunia advisory.
Apple's QuickTime was updated on February 6th to fix a security problem. The latest version is 7.4.1. The update affects Mac OS X v10.3.9, v10.4.9, v10.5, Windows Vista and Windows XP SP2. You can download it here and see the Secunia advisory . Apple has a software update service for both Macs and Windows, but I'm not familiar with it.
Skype was updated on February 5th to fix a security problem that only affects Windows users. The new version of Skype for Windows is 3.6.0.248. You can download the latest Skype software here. For more, see the Secunia advisory or read about the problem from Skype.
Windows users can check for software that is missing bug fixes using the online Secunia Software Inspector .
Not So Recent Bug Fixes
Java was updated a few weeks ago, but there was confusion about the need for the latest version, 1.6.0_04. I wrote about this on February 8th, see Sun's Java sloppiness.
Update. February 13, 2008: Sun provides recent copies of Java for Windows, Linux and Solaris here but not for Macs. At this Java.com download page, Sun links to Apple's web site, where the available versions of Java are very old. Specifically, this page offers downloads of Java version 1.5.0_08 and 1.4.2_12. More recent was the December 13, 2007 release by Apple of Java for Mac OS X 10.4 which offers up versions 1.5.0_13 and 1.4.2_16. Despite the title, it seems as if these versions of Java are supported on Leopard (10.5). I am not a Mac user so I can't test this myself. If and when Apple will release a version of Java in the 1.6.x family is anyone's guess. For more see developer.apple.com/java/.
To see which version of Java is installed on your computer, you can use my javatester.org web site. Be sure to check in every web browser that you use.
The confusion included Secunia recommending version 1.6.0_04, while Sun recommended version 1.6.0_03. Since writing about this on the 8th, I've been in contact with Sun. I'll have more to say on this later, but suffice it to say that version 1.6.0_04 contains many updates but only one that might be considered a security update. Sun's position is that version 1.6.0_03 is secure for normal consumer usage.
If you are running version 1.6.0_03, it may not be worth the trouble to update to the latest version. If you have an earlier version of the 1.6 family however, then you should update and, if you're going to update, you might as well go for 1.6.0_04. The last version of the previous 1.5 family is 1.5.0_14. According to Secunia, this version is secure, but earlier versions of 1.5.x are not.
Before updating Java, I suggest removing older versions. Windows users can do this with the usual Add/Remove programs thingy in the Control Panel (I say "thingy" because when discussing Java, the normal term, "applet", has a specific non-Windows meaning).
The latest version of Adobe Flash player was released in mid-December. I mention it here because it fixed a number of critical security bugs, everybody has a copy and didn't get a lot of publicity.
To see which version of the Flash player is installed on your computer, go to www.adobe.com/products/flash/about/. The latest is version 9,0,115,0. As with Java, you need to check this in all web browsers on your computer as different browsers can be using different versions.
I wrote about updating the Flash player on January 28th, see A heads-up on the Adobe Flash player. For safety, old version(s) should be manually un-installed before installing a new version. Unfortunately, removing the Flash player can be problematical. My blog posting has more on this, but after removing the Flash player, check with the above web page, that each browser on your machine is, in fact, not able to access Flash. Adobe has a dedicated Flash Player un-installer, if need be.
The latest version of the Flash player is available at www.adobe.com/go/getflashplayer.
Operating Systems Too
Both Windows and the Mac OS X were also just updated.
Updates to Mac OS X were released yesterday (February 11th). The latest Leopard is now 10.5.2. For more, see this from Apple docs.info.apple.com/article.html?artnum=307109 and Apple updates Leopard, Tiger with security updates from fellow CNET blogger Robert Vamosi. I couldn't find any references to recent Tiger (10.4) bug fixes at Apple's web site.
All users of Mac OS X should read Mac OS X: Updating your software from Apple.
Update: February 13, 2008: The title says it all: Rush Limbaugh begs Steve Jobs for bug fixes.
The latest Microsoft bug fixes roll out today, February 12th, otherwise known as "Patch Tuesday". Some fixes are for Windows, some are for Microsoft Office. Specifically, there are bug fixes for Windows 2000, XP, Vista and Server 2003 as well as Office 2000 and 2003 and Office for the Mac 2004.
For the gory details see Microsoft Security Bulletin Advance Notification for February 2008 from Microsoft and Microsoft fixes 17 flaws in 11 patches; 6 are critical by CNET blogger Robert Vamosi.
I need your help here. The latter article starts with "Microsoft on Tuesday released its February 2008 security bulletin, which includes eleven bulletins, six of which are deemed Critical by Microsoft, while five are deemed Important."
The latest soft word in the bug field seems to be "bulletin". I missed the memo. What's a bulletin? Is it a bug? A bug fix? A description of the bug? How can the February bulletin include eleven bulletins?
See a summary of all my Defensive Computing postings.
Yet again, a bug fix created a new problem. This time it occurred with Internet Explorer 6 and 7 on Windows XP and Vista.
The problem is that Internet Explorer crashes after viewing a web page. Not all web pages though, I was able to successfully view about half of those I tested with IE6. One site that crashes it pretty quickly is Microsoft's own msn.com (they offered it as an example).
It wasn't hard to find information online about this problem which was introduced in the December 11th round of bug fixes to Windows.
According to Computerworld, reports came in immediately after the release of the December 11th patches, about problems with Internet Explorer. I was just hit with this because I always wait a bit before installing new bug fixes. This wasn't the first time that a poorly tested fix created a new problem.
To document the problem Microsoft created Knowledge Base article 946627.
On December 18th, Microsoft offered a work-around in the form of a registry zap. Not your most user-friendly undertaking.
On December 20th, however, they incorporated the registry zap into a downloadable EXE file, and updated the Knowledge Base article with a link to the file.
Uninstalling
Rather than fix the fix with a registry zap that seems to target the symptom rather than the underlying problem*, my first reaction was to un-install the buggy bug fix.
Windows XP users can do this using the "Add or Remove Programs" applet in the Control Panel (see above). At the top of the window, turn on the checkbox for Show updates and sort by date last used. Then, scroll to the bottom and look for KB942615.
When I did this however, I was scared off by the warning message shown above. Even if I was willing to risk breaking two other bug fixes, I want no more to do with the Adobe Flash player. If you try this, please leave a comment below about the patches and applications, if any, that you get warned about.
Installing
You can download the automated registry zap here . The file is WindowsXP-KB946627-x86-ENU.exe, and running it starts up a Wizard (below) that walks you through a simple, standard installation process.
I suggest making a restore point before installing anything. Can't hurt. In my case, the fix was immediate, there was no need to restart Windows.
According to this Microsoft Security Response Center blog posting the newly automated fix has been incorporated into windows update.
<sarcasm>
Considering how so few people use Internet Explorer and even fewer use Windows XP and Vista, combined with the limited resources of the company that produced both products, it's no surprise that quality assurance for the original bug fix might be lacking.
</sarcasm>
* According to Heise Security, "the update does not really fix the problem..."
See a summary of all my Defensive Computing postings.
- prev
- 1
- next
