Don’t go near the water

Dori shares a sad tale of swimwear that’s not meant for swimming:

I called the company up today to complain and was told that (wait for it) their suits are not appropriate for wearing into pools or hot tubs, as that may cause colors to run or fade.

That’s pretty cool– sort of like those fake fruit bowls at my doctor’s office.

Comments Off on Don’t go near the water

Filed under Musings

Buffer overflow in IIS WebDAV: Patch it now!

Microsoft has MS03-007 out. The bulletin describes a buffer overflow vulnerability in the WebDAV component of IIS 5.0 on W2K; Windows 2003 and Windows XP aren’t affected. The practical effect of this vuln is that an attacker can run code of her choice on your server (at which point it’s not really your server anymore.) The worst part is that an exploit for this problem is already circulating.
There are several ways to avoid this problem:

  • If you were already running URLScan, you’re in good shape. Its whole purpose is to block malformed or bogus requests before IIS ever gets them. If you’re not running URLScan, well, why not?
  • Go to the download page and download the patch. It’s a self-installing executable; after installing it, stop and restart the W3SVC service. You don’t need to reboot.
  • Go to
    Windows Update
    and scan for the patch. The Windows Update installer may prompt you for a reboot.

  • Use the Automatic Updates client to download and install the patch. Unfortunately, this route will prompt you for a reboot, although you can sneak by by killing its process and bouncing the W3SVC service.
  • Disable or remove IIS. Obviously you can’t do this for your Exchange servers, but other servers may not need IIS. See KB article 321141 for details.
  • Disable WebDAV only. This is easy to do.
  • Download the URL Buffer Size Registry tool and use it to set the MaxClientRequestBuffer value. Microsoft recommends setting MaxClientRequestBuffer to 16K, but in the same sentence they warn that doing so may break “some programs.” In my testing, a setting of 16K didn’t seem to interfere with OWA or Exchange, but your environment may have a different mix of requests. I’ve asked MS for a definitive statement on this; in the meantime, you can either use a larger value or use URLScan, which has templates for OWA. (Side note: of course, by reading KB article 816930 you could make this change yourself, but the tool can scan multiple machines to find those that haven’t had this limit applied).
  • If you choose to apply MaxClientBufferSize, you should probably also use a group policy setting to apply the registry key and you’re in business.

What about long-term solutions? Well, you should definitely be using IIS Lockdown on all your Windows 2000 servers. If you combine that tool with reasonable attention to patches, you will be in relatively good shape. You should aggressively follow up with MBSA scans to check for correct patch installation. In almost all cases, your life will be easier if you deploy the Software Update Service (SUS) to pull patches and stage them for mass installation. When I get a free minute, I’ll be writing an article here describing exactly how to use SUS.
In the meantime, if you read and follow the recommendations in chapters 6 and 14 of the book, you can relax.

Comments Off on Buffer overflow in IIS WebDAV: Patch it now!

Filed under Security

Too bad most of my friends are married

I wonder how long it’ll take for eBay to remove this Instant Girlfriend kit from auction.

Comments Off on Too bad most of my friends are married

Filed under Uncategorized

Kung-Tunes

So, I finally found out how to make my blog reflect what I’m listening to: Kung-Tunes is a small background application that asks iTunes what’s playing, formats the result using a template I specify, and uploads it using scp. Worthless, but nifty.

Comments Off on Kung-Tunes

Filed under General Tech Stuff

Get Smart

So, as everyone within range of a television knows, Elizabeth Smart was found and returned safely to her family. Now the Salt Lake Police Department has some explaining to do (they seem to be better than Boulder but nowhere near the NYPD). But that’s not what I wanted to talk about; instead, what’s with all this “it’s a miracle” talk?
Don’t get me wrong. I know full well that God answers our prayers; I have a firm testimony of that. What I see missing from most accounts is the connection between her safe return and the fact that Elizabeth’s family never gave up. They continued to work to get the word out, and they were aggressive in prodding the slow-moving SLPD to get with the program when their younger daughter identified the handyman as the perp. Their hard work helped implement the miracle. It’s tempting to dismiss this as another case of “God helps those who helps themselves,” but I prefer to think of it in another way. My friend James Harris often advised people in difficult situations thusly:

Get down on your knees and pray as though everything depended on the Lord. Then get up and work at it as if everything depended on you alone.

Comments Off on Get Smart

Filed under Spiritual Nourishment

TechNet chat: Using ISA Server to Securely Publish Exchange Server

TechNet is sponsoring yet another Exchange security chat, this one with folks from the ISA Server product team. April 9, from 1200-1300 EST / 0900-1000 PST / 1600-1700 GMT.

Comments Off on TechNet chat: Using ISA Server to Securely Publish Exchange Server

Filed under General Stuff, Musings

New post-SP3 rollup for Exchange 2000

Technically, this isn’t a security alert, but Microsoft has released the first post-SP3 rollup fix for Exchange 2000. KB article 813840 links to the list of fixes.
There’s a companion set of fixes for the Active Directory Connector. KB article 815452 contains its list of fixes.
UPDATE: Microsoft has pulled the downloadable update, citing mismatches between the rollup binaries and the associated symbol files. They haven’t yet provided an ETA for restoring the download, although the KB articles are still there.

Comments Off on New post-SP3 rollup for Exchange 2000

Filed under Security

One more reason to love truck stops

So, while I was in Seattle, McDonald’s announced that it’s going to start offering wireless access in its stores. This is interesting insofar as it shows how WiFi is spreading beyond traditional geek havens. However, last night while driving home from the airport, I stopped for gas. Turns out that T/A Travel Centers, a large network of truck stops, is adding WiFi access too. (They’re still rolling it out, and I have a call in to their project leader to get more details). I already favor the Monroe T/A because it has the nearest Popeye’s, so this is an extra bonus.
This provides terrific proof that the market for widespread WiFi is still growing rapidly. I love the idea that I can combine fueling and emailing, even though I can get email on a handheld. Of course, I could go off on a lengthy digression about how stupid it is that most major airports (which, as you may have noticed, are often filled with impatient laptop-toting connectivity junkies) don’t have WiFi but that truck stops and fast-food restaurants do, but I’ll spare you.
Now, to teach my 8-year-old how to pump gas so I can stay inside and use the laptop…

Comments Off on One more reason to love truck stops

Filed under General Tech Stuff

Free SQL security chapter

Just in from NTbugtraq: Erik Birkholz is giving away the SQL Server chapter from his new book, SPECIAL OPS: Host and Network Security for Microsoft, UNIX, and Oracle. I have no idea if the chapter is good or not; I do know that the book’s Exchange chapter was written by Jim McBee, who knows how many beans make five. You can get it directly, or check out the book’s cool web site (much cooler than this one, I must admit.)

Comments Off on Free SQL security chapter

Filed under General Stuff

It’s what’s for dinner

I decided to try Daypop, and what to my wondering eyes did appear but a link to “International Eat an Animal for PETA Day”. I don’t agree with PETA’s central premise, but I’m more than happy to let them express their opinion. However, I find it deeply offensive that they terrorize people (yes, arson counts) who disagree with them, all the more so that they’re now using the Holocaust as a metaphor for meat consumption. Comparing the Holocaust to large-scale chicken or beef farming– thus equating Chicken Little to a man, woman, or child– is way over the line in my book. Accordingly, I’m going to write them a nastygram and tuck in to a big old plate of some kind of critter.

Comments Off on It’s what’s for dinner

Filed under Musings

Beignet, done that

Happy Mardi Gras! For breakfast, Arlene made beignets and bacon. For supper, it’s crawfish étouffée, red beans and rice, and all the trimmings– the beads are hung, and the boudin balls will be on the snack platter a bit later. We’ve even got a midnight snack planned. Laissez les bons temps rouler!

Comments Off on Beignet, done that

Filed under Uncategorized

The next target after Iraq

WASHINGTON (AP): In a speech that surprised even such high-level Republican confidantes as Bill Frist, Tom Delay, and Brit Hume, US Secretary of Defense Donald Rumsfeld today called on Congress to allow President Bush to proceed with plans for military action against the state of Louisiana.
“We do not have the luxury of time to debate our strategy,” Rumsfeld told a
group that included members of the Senate and House Armed Services Committees, leaders of both houses of Congress, and selected members of the
news media.
“Louisiana has demonstrated, time and time again, that it is not interested
in peaceful coexistence with the United States,” the Secretary claimed. “The leadership there says one thing and does another. They tell the world that they have no desire to be aggressive, yet we have proof beyond a doubt that they are producing weapons of mass destruction, and that they would use them against us, especially if they had too much to drink.”
“Louisianians are like that,” he added.
When asked what types of weapons of mass destruction Louisiana had, Rumsfeld turned the podium over to Secretary of State Colin Powell, who produced a series of line drawings of Tabasco Sauce bottles and containers of cayenne pepper.
“They have capsaicin,” said Powell. “And frankly, we have never before seen chemical weapons of this intensity. Each small bottle of Tabasco sauce contains 720 drops. A teaspoon of the stuff has 60 drops. Two to three drops of capsaicin at these levels can disable someone, and five to six drops can cause choking, heart palpitations, respiratory decompensation, and even death. Four drops if the person is from Minnesota.”
Powell went on to describe Scoville units, the units by which pepper heat is measured, and said that the deadly chemical was produced in a remote part of Louisiana known as Avery Island. According to the dossier from which Powell read, when all four production lines of the Avery Island factory are in operation, over 450,000 bottles of Tabasco can be produced in a single day.
“That is enough to kill every man, woman and child in the free world many
times over,” he said.
Secretary Rumsfeld then returned to the podium and fielded questions about his new military directive, which he called a necessary assault on what President Bush is referring to as the Axis of Carville.
“The President believes, and I agree with him, that no one in America is safe until Louisiana is disarmed,” Rumsfeld announced. When asked about the possibility of sending UN weapons inspectors to Louisiana, Rumsfeld became impatient:
“There you go again, with the inspection song and dance. Don’t you think that hasn’t been tried? Every inspector that was ever sent there wound up in New Orleans, and came back drunk and weighing an extra ten pounds. If you knew anything at all about Louisiana, you wouldn’t be asking such an inane question.”
Asked about the possibility of allowing Louisiana time to disarm on its own, Rumsfeld said intelligence reports showed that if left to their own devices, the state’s leaders would eventually distribute capsaicin throughout every major city in the United States. There are already more than a thousand Popeye’s Fried Chicken franchises in the country, he said, and there are many other ways to introduce capsaicin to the population.
“But what about Governor Foster?” a reporter asked. “Isn’t he a Republican?”
Rumsfeld smiled. “We’re really not sure anymore, after the November election,” he said, “and anyway, his term will be up soon. And if you don’t think Mary Landrieu knows about the Tabasco plant, you are more naïve than even I could imagine.”
Later, at a briefing on the latest addition to the growing list of places
the United States will attack, Press Secretary Ari Fleischer was asked if
President Bush had visited Louisiana. Fleischer replied, “He thinks he may
have been there when he was governor of Texas, but he isn’t sure when. I
think right now it’s somewhat murky.”
“Louisiana has a lot of oil, Ari,” Helen Thomas asserted. My understanding is that it has 18 petroleum refineries, 27,250 producing wells, and is home to two of our four strategic oil reserves. Do you want us to believe that the proposed attack on Louisiana isn’t part of the White House’s plan to confiscate oil on a World-Wide basis?”
“Helen, it’s certainly true that Louisiana has a crude oil reserve of 529 million barrels of oil, but the president has no interest in that. What he does have an interest in is the security of the American people, and that security cannot be maintained unless Louisiana is disarmed of its stash of chemical weapons.”
With that remark, Fleischer ended the news conference. Later, however, reporters had a chance to talk with President Bush, who invited some of them to the golf course.
Asked if he thought an attack on Louisiana would be hard to sell to the American people, the president replied that American citizens were becoming more and more suspicious of the motives of foreign countries, and that they would not hesitate to do whatever was necessary to protect national security. When told that Louisiana was one of the fifty states, Bush nodded and said “God bless America.”
Asked about allegations that the White House wanted to attack Louisiana for
its oil, Bush turned and faced the group.
“I can assure you,” he said, “I know all about the allegations. They are crawling around all the swamps in Louisiana. Some of them are ten feet long. Make no mistake: we will hunt them down, and we will bring them to justice.”
The reporter reminded President Bush that Texas had even larger oil reserves than Louisiana. “Can we expect a future attack on Texas, too?”
The President turned toward the second hole. “Now watch this drive,” he said, then, turning and winking, added, “Don’t mess with Texas.”
original source unknown; courtesy of my mom

Comments Off on The next target after Iraq

Filed under Smackdown!

On-target spam

I get the usual daily quota of the 3 Ps (porn, pharmaceutical, and pasta bowls), but today brought me something new from “queen thacker”:

We are the septic tank doctors.
Please visit us for information on how to keep your system trouble free andtry the product at no cost……
http://www.egg-noodles-pasta.com/
wkkrakyfdpnetapmy h yiotv pth kvcbfitbd
corrbouxgdt
hvw caitjvxo

I’m not sure if this is spam or some kind of coded message to the Iraqi resistance.

Comments Off on On-target spam

Filed under Musings

Media Gone Mad

Woo! If I was a drinker, I’d buy Tim Mullen a beer for this column.

Comments Off on Media Gone Mad

Filed under Smackdown!

TechNet chats: wireless & Exchange security

Two more security-related TechNet chats to announce this week:

  • Wireless security (March 5, 1000 PST/1300 EST/1800 GMT). Are you thinking about setting up a wireless network at the office? At home? If so, you won’t want to miss this chat. We can answer questions about how to control who accesses your network, WEP, and integration with Windows. (Attend the web cast immediately prior to this chat for additional information on wireless security.)
  • Exchange security (March 5, 0700 PST/1000 EST/1500 GMT) Come and ask your questions relating to Exchange Security. Questions can range from email virus protection to encryption to OWA configurations. Come test your questions against skilled Microsoft Technology Specialists.

Comments Off on TechNet chats: wireless & Exchange security

Filed under General Stuff, Musings