Linux is well-known for its security advantages over many other operating systems, but that doesn't mean it's immune to problems.
A Linux kernel flaw first discovered earlier this month, for example, gives hackers a way to not just gain root privileges in 64-bit Linux operating systems but also to leave a "back door" open for further exploitation later.
CVE-2010-3081, as the high-profile vulnerability is known, affects virtually all users of 64-bit Linux distributions, including RHEL, CentOS, Debian, Ubuntu, CloudLinux, SuSE and more. It was introduced into the Linux kernel back in 2008, and a hacker by the name of 'Ac1db1tch3z' last week published details on exploiting it.
Click here for more info.
Note:
Text copied from PCWorld news.
Wednesday, September 22, 2010
Tuesday, September 21, 2010
Using linear gradient effect accross browsers...
filter: progid:DXImageTransform.Microsoft.gradient(gradienttype=1, startColorstr='#739AC5', endColorstr='#ffffff'); /* for IE */Note:
background: -webkit-gradient(linear, left center, right center, from(#739AC5), to(#fff)); /* for webkit browsers */
background: -moz-linear-gradient(left, #739AC5, #fff); /* for firefox 3.6+ */
Click here for codes and colour table.
Vulnerability in the ASP.NET encryption...
The Impact of the Vulnerability
ASP.NET uses encryption to hide sensitive data and protect it from tampering by the client. However, a vulnerability in the ASP.NET encryption implementation can allow an attacker to decrypt and tamper with this data.
But what can the attacker do with this capability? Part of the answer depends on the ASP.NET application being attacked. For example, if the ASP.NET application stores sensitive information, such as passwords or database connection strings, in the ViewState object this data could be compromised. The ViewState object is encrypted and sent to the client in a hidden form variable, so it is a possible target of this attack.
If the ASP.NET application is using ASP.NET 3.5 SP1 or above, the attacker could use this encryption vulnerability to request the contents of an arbitrary file within the ASP.NET application. The public disclosure demonstrated using this technique to retrieve the contents of web.config. Any file in the ASP.NET application which the worker process has access to will be returned to the attacker.
How the Vulnerability Works
To understand how this vulnerability works, you need to know about cryptographic oracles. An oracle in the context of cryptography is a system which provides hints as you ask it questions. In this case, there is a vulnerability in ASP.NET which acts as a padding oracle. This allows an attacker to send chosen cipher text to the server and learn if it was decrypted properly by examining which error code was returned by the server.
By making many requests the attacker can learn enough to successfully decrypt the rest of the cipher text. The attacker can then alter the plain text and re-encrypt it as well.
The Workaround - Silencing the Oracle
The workaround for this vulnerability is to use the customErrors feature of ASP.NET to configure applications to return the same error page regardless of the error encountered on the server.
By following the steps in the advisory to map all error messages to a single error page, you make it difficult for the attacker to distinguish between the different types of errors, effectively limiting access to the oracle.
How to Detect Vulnerable ASP.Net Applications
Script can be obtain from the original article.
Note:
Text copied from blogs.technet.com.
The vulnerability affects all versions of .NET Framework. Click here for detail.
ASP.NET uses encryption to hide sensitive data and protect it from tampering by the client. However, a vulnerability in the ASP.NET encryption implementation can allow an attacker to decrypt and tamper with this data.
But what can the attacker do with this capability? Part of the answer depends on the ASP.NET application being attacked. For example, if the ASP.NET application stores sensitive information, such as passwords or database connection strings, in the ViewState object this data could be compromised. The ViewState object is encrypted and sent to the client in a hidden form variable, so it is a possible target of this attack.
If the ASP.NET application is using ASP.NET 3.5 SP1 or above, the attacker could use this encryption vulnerability to request the contents of an arbitrary file within the ASP.NET application. The public disclosure demonstrated using this technique to retrieve the contents of web.config. Any file in the ASP.NET application which the worker process has access to will be returned to the attacker.
How the Vulnerability Works
To understand how this vulnerability works, you need to know about cryptographic oracles. An oracle in the context of cryptography is a system which provides hints as you ask it questions. In this case, there is a vulnerability in ASP.NET which acts as a padding oracle. This allows an attacker to send chosen cipher text to the server and learn if it was decrypted properly by examining which error code was returned by the server.
By making many requests the attacker can learn enough to successfully decrypt the rest of the cipher text. The attacker can then alter the plain text and re-encrypt it as well.
The Workaround - Silencing the Oracle
The workaround for this vulnerability is to use the customErrors feature of ASP.NET to configure applications to return the same error page regardless of the error encountered on the server.
By following the steps in the advisory to map all error messages to a single error page, you make it difficult for the attacker to distinguish between the different types of errors, effectively limiting access to the oracle.
How to Detect Vulnerable ASP.Net Applications
Script can be obtain from the original article.
Note:
Text copied from blogs.technet.com.
The vulnerability affects all versions of .NET Framework. Click here for detail.
Monday, September 20, 2010
64-bit Adobe Flash Player for Linux is back...
Adobe has finally made the announcement a lot of Linux users have been waiting for, a 64-bit version of the Adobe Flash Player is again available. Not only that, it's a significant improvement over previous releases.
This should appease most Linux users and it's clear that Adobe is committed to creating a native 64-bit plugin. A stable version should be coming soon now.
Unfortunately, although part of the announcement was support for hardware acceleration in Internet Explorer 9, there is still no support whatsoever for GPU acceleration on Linux.
Note:
Text copied from Softpedia news.
This should appease most Linux users and it's clear that Adobe is committed to creating a native 64-bit plugin. A stable version should be coming soon now.
Unfortunately, although part of the announcement was support for hardware acceleration in Internet Explorer 9, there is still no support whatsoever for GPU acceleration on Linux.
Note:
Text copied from Softpedia news.
Wednesday, September 8, 2010
Numeric textbox javascript...
<input type='text' onkeydown='text_keydown(event)' />
<script language='javascript' type='text/javascript'>
function text_keydown(e)
{
var key;
document.all ? key = e.keyCode /*IE*/ : key = e.which /*FF*/;
if(!(key > 47 && key < 58) && key != 8 && key != 37 && key != 39 && key != 16 && key != 46)
{
cancelevent(e);
}
}
function cancelevent(e)
{
if(window.event) // IE
{
window.event.returnValue = false;
}
else // FF
{
e.preventDefault();
}
}
</script>
Tuesday, September 7, 2010
What's new in Ubuntu 10.10...
1) Simpler Installer.
Ubuntu 10.10 is expected to use a new installer that makes the installation process simpler than ever. Startup options are now placed right in the installer itself, and they include just two options: Try Ubuntu and Install Ubuntu. A simplified partitioner, meanwhile, lets users choose between automatically using the whole disk and manual partitioning, while a new Wireless Network Selection page will be added as well. These features will be particularly helpful for newer Ubuntu users.
My response:
I've started with 6.10 (Edgy Eft) and never felt it's difficult to install Ubuntu (it's the same 6 clicks process, except for the partitioning part might be a little bit tricky for newbie). Overall installing desktop Linux couldn't be more difficult than Windows unless if you're talking about pre Red Hat 7 era in 90s.
2) Processor Support.
It sounds like the Maverick Meerkat will not run on processors older than i686, or anything before Intel's P6 microarchitecture. For most business users this probably won't be an issue, but it could affect some occasional users of older machines.
My response:
I don't need to worry about this because I don't have that kind of old machine. :)
3) Default Environment and Applications.
Ubuntu 10.10 Beta uses version 2.6.35.3 of the Linux kernel, which includes numerous security enhancements over previous versions. It also updates the GNOME desktop environment to version 2.31.
Among application changes, meanwhile, is that Firefox 3.6.8 will be the default, as will OpenOffice 3.2.1, for example. Photo tool F-Spot has been replaced with Shotwell, while a new sound indicator has been enhanced to include music player controls.. The Evolution mail and collaboration software will be updated to the 2.30.2 version, which reportedly is much faster than the one in Ubuntu 10.04 LTS, or Lucid Lynx.
My response:
I never use F-Spot and Evolution mail. For image editing, Gimp is my preference. Sound indicator to include music player controls sounds cool to me.
4) The Ubuntu Software Center
In version 10.10, the Ubuntu Software Center--the tool for browsing, installing and removing software on Ubuntu--will gain "Featured" and "What's New" choice icons on the front page, along with a "History" tab displaying recently installed software. It is also said to be faster and more responsive. Taken together, these improvements promise to make it much easier to track and find new software options.
My response:
This should be interesting. Might change to this instead of Synaptic.
5) Multitouch
Making the biggest splash, of course, will be the new multitouch and gesture capabilities, which will apparently make it possible for basic gestures to be chained, or composed, into more sophisticated "sentences." Toward that end, Canonical has created an open source gesture recognition engine and defined a gesture API that provides a way for applications to respond to users' gestures.
Canonical is currently targeting the Dell XT2 as a development environment for this new feature, but by release it expects it to be compatible with a range of devices from major manufacturers, and with add-ons like Apple's Magic Trackpad. Needless to say, this will pave the way toward a host of new capabilities on the Linux desktop and beyond.
My response:
Unfortunately I don't have any hardware with the capability to benefit this feature.
Note:
Text copied 97% from PCWorld news with a reference to The Fridge.
Ubuntu 10.10 is expected to use a new installer that makes the installation process simpler than ever. Startup options are now placed right in the installer itself, and they include just two options: Try Ubuntu and Install Ubuntu. A simplified partitioner, meanwhile, lets users choose between automatically using the whole disk and manual partitioning, while a new Wireless Network Selection page will be added as well. These features will be particularly helpful for newer Ubuntu users.
My response:
I've started with 6.10 (Edgy Eft) and never felt it's difficult to install Ubuntu (it's the same 6 clicks process, except for the partitioning part might be a little bit tricky for newbie). Overall installing desktop Linux couldn't be more difficult than Windows unless if you're talking about pre Red Hat 7 era in 90s.
2) Processor Support.
It sounds like the Maverick Meerkat will not run on processors older than i686, or anything before Intel's P6 microarchitecture. For most business users this probably won't be an issue, but it could affect some occasional users of older machines.
My response:
I don't need to worry about this because I don't have that kind of old machine. :)
3) Default Environment and Applications.
Ubuntu 10.10 Beta uses version 2.6.35.3 of the Linux kernel, which includes numerous security enhancements over previous versions. It also updates the GNOME desktop environment to version 2.31.
Among application changes, meanwhile, is that Firefox 3.6.8 will be the default, as will OpenOffice 3.2.1, for example. Photo tool F-Spot has been replaced with Shotwell, while a new sound indicator has been enhanced to include music player controls.. The Evolution mail and collaboration software will be updated to the 2.30.2 version, which reportedly is much faster than the one in Ubuntu 10.04 LTS, or Lucid Lynx.
My response:
I never use F-Spot and Evolution mail. For image editing, Gimp is my preference. Sound indicator to include music player controls sounds cool to me.
4) The Ubuntu Software Center
In version 10.10, the Ubuntu Software Center--the tool for browsing, installing and removing software on Ubuntu--will gain "Featured" and "What's New" choice icons on the front page, along with a "History" tab displaying recently installed software. It is also said to be faster and more responsive. Taken together, these improvements promise to make it much easier to track and find new software options.
My response:
This should be interesting. Might change to this instead of Synaptic.
5) Multitouch
Making the biggest splash, of course, will be the new multitouch and gesture capabilities, which will apparently make it possible for basic gestures to be chained, or composed, into more sophisticated "sentences." Toward that end, Canonical has created an open source gesture recognition engine and defined a gesture API that provides a way for applications to respond to users' gestures.
Canonical is currently targeting the Dell XT2 as a development environment for this new feature, but by release it expects it to be compatible with a range of devices from major manufacturers, and with add-ons like Apple's Magic Trackpad. Needless to say, this will pave the way toward a host of new capabilities on the Linux desktop and beyond.
My response:
Unfortunately I don't have any hardware with the capability to benefit this feature.
Note:
Text copied 97% from PCWorld news with a reference to The Fridge.
Monday, September 6, 2010
VB.NET vs C#, why bother? We're .NET developers after all...
I can't believe that people are still debating on this topic. While searching for anonymous methods in VB.NET, I came across to this article "Top 10 reasons VB.NET is better than C#". It was posted on August 23rd 2004 and the last comment was on August 31st 2010!!!
Update:
Did a search further with keyword "vb.net vs c#" and found out that there's another article from the same person on the same day, but this time it's the other way around. "Top 10 reasons C# is better than VB.NET".
Update:
Did a search further with keyword "vb.net vs c#" and found out that there's another article from the same person on the same day, but this time it's the other way around. "Top 10 reasons C# is better than VB.NET".
Subscribe to:
Posts (Atom)