Microsoft has issued a warning about a serious vulnerability in Microsoft Office Web Components software. The vulnerability applies mainly to Office XP and Office 2003 Web Components.

An attacker can exploit this vulnerability to gain access to a computer with the same rights as the local user. This may not require any user intervention to exploit the vulnerability.

There is no patch available for this vulnerability at present from Microsoft. However Microsoft has published some mitigation information along with further details at their official webpage below. If you require further information on this vulnerability, you can also read it at this site.

http://www.microsoft.com/technet/security/advisory/973472.mspx

An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. When using Internet Explorer, code execution is remote and may not require any user intervention.

There is no patch available for this vulnerability at present from Microsoft.  The workaround that they suggest is to disable ActiveX controls in Internet Explorer.  Unfortunately disabling ActiveX could have a large impact on business critical websites.

If you require more information on this vulnerability, you can read the official Microsoft webpage at http://www.microsoft.com/technet/security/advisory/972890.mspx or call Computer Concepts on 03-348-2500.

2. Alternative Operating Systems
Every good thing must come to an end, including the supposed safety of “alternative” platforms. Threats exploiting bugs on alternative operating systems will grow, especially with the increasing popularity of Mac and Linux (the latter because of the booming Netbook market).

3. Microsoft—the Eternal Target
Malware authors just love to pick on Microsoft and 2009 promises to be no different. Look for malware activity around the release of Windows 7 as cyber criminals will undoubtedly test any claims that the new Windows is “virus-free.” Proof-of-concept malware will also exploit Microsoft Surface, Silverlight, and Azure. Also, cyber criminals will continue to employ a more professional approach to leverage the exploit window of opportunity presented by Microsoft’s monthly “Patch Tuesday” schedule,” in which zero-day exploits continue to trouble Microsoft users.

4. Social Engineering Hits the Big Time
Cybercriminals will continue to leverage events, celebrities, and political figures as social engineering bait. U.S. elections-related malware will continue until (and after) the president-elect steps into the Oval Office in January, while gamers anticipating upcoming releases of Starcraft 2 and WoW: Wrath of the Lich King should also be wary. And capitalizing on the global financial crisis, cyber criminals will play on the consumer landscape of thrift, creating economically-themed emails, fake e-coupons, bogus work-at-home schemes, and other efforts to cash in on consumers’ desire to save money.

5. Cyber Gang Wars
Security researchers are seeing virus wars, worm wars, and botnet wars—due to increasing competition for financial gains from phishing and fraud, as well as the downsizing of criminal cyber gangs, and improvements in security solutions. Look for growing competition in Eastern Europe vs. China to determine which country’s crooks will be the first to include the latest exploits in their exploit kits.

6. The Growing Reality of Virtual Threats
Many threats encountered in the real world also crop up in the virtual world. Since cybercriminals need large audiences to perpetrate their crimes, they have begun preying on residents in virtual worlds and players in online games. The number and kind of threats in virtual worlds runs the gamut of human behaviour and can be as innocent as password sharing between partners, as sophisticated as real estate fraud, and as malicious as gangs hunting for newbies to kill. Look for virtual threats to become an even greater problem in 2009.

7. Broken Down DNS
Cyber criminals will leverage identified loopholes in the DNS (domain name system) registry loopholes to perpetrate their schemes. According to experts, bad guys are already using the poisoned DNS cache to create covert communications channels, bypass security measures, and serve-up malicious content. Although the security community, including Trend Micro, is working closely with registries/registrars where possible, this is an issue that ICANN (Internet Corporation for Assigned Names and Numbers) must address.

8. Underground Economy Continues to Flourish
Cyber crime has become big business and unfortunately, 2009 will witness its continued growth. Increases in info-stealing malware, geared toward stealing login credentials and banking and credit card information, will continue to thrive because that’s where the money is, and let’s face it—most cyber crime is financially motivated.

9. Clever Malware on the Rise
Advancements in malware technologies are a sure bet as malware authors continue to develop and release code that aims to avoid detection and consequent removal. Thus, you will see more malware families but fewer variants, making it more and more difficult for AV companies to create heuristic patterns to detect them. The bigger problem is the sheer size and frequency of updating these pattern files—actually a greater problem than the malware itself!

10. Good Guys on the Horizon
Not all news is grim. Effective community efforts are beginning to take down offending threat vectors. Collaborative efforts are becoming increasingly well planned, coordinated, and targeted—a breath of fresh air in a movement that says “enough with the hand wringing, and time for action.” As people become more fed up with the audacity of cyber criminals and pockets of identified criminal activity, community sourced efforts will expose more Bad Actors, such as the takedown of Atrivo/Intercage and McColo in 2008. Good news!.

“Citrix Essentials for Hyper-V will enable Microsoft customers to obtain even more value from their investments in the Windows platform and Microsoft virtualisation solutions,” said Mike Neil, general manager, virtualisation strategy, Microsoft Corp. “We see Citrix Essentials as a powerful extension that enables customers to accelerate their Hyper-V adoption in the enterprise in much the same way Citrix XenApp has extended the Windows Server platform for nearly 20 years in the application delivery arena. Microsoft also will work to ensure that a future release of Microsoft System Centre will support Citrix XenServer for customers with mixed Hyper-V and XenServer environments.”
In another move to counter VMware’s lead, is to make its XenServer software free. “This move is all about accelerating the adoption of virtualization by tearing down the barriers of cost and complexity that have been in place for far too long,” said Simon Crosby, CTO, Virtualization Management Division, Citrix. The new free Citrix XenServer release will be available for download from the Citrix website by the end of March 2009.

One of the most powerful and innovative new features in the Citrix Essentials product line is the Citrix StorageLink technology.

The StorageLink capabilities in Citrix Essentials include the following four feature sets:

* StorageLink Gateway enables automated discovery and one-click access to native storage services using any of the leading storage architectures and protocols, including DAS, NAS, SAN, iSCSI and Fibre Channel.

* StorageLink Resource Manager makes common actions in native storage arrays visible from within the virtualization management environment, including partitioning, snapshots, backups and data replication.

* StorageLink Image Manager provides a centralized library of virtual machine images that can be instantly converted between XenServer and Hyper-V and rapidly cloned and delivered to any number of target hosts.

* StorageLink Connect provides a set of clearly-defined open APIs that make it easy to link XenServer and Hyper-V environments to third-party backup solutions and enterprise management frameworks.

“With three-quarters of servers still not virtualized and customer choices increasing, the virtualization market is still wide open”, according to Peter Levine, senior vice president and general manager of the virtualization management division at Citrix.

Citrix Essentials for XenServer was made available from Citrix resellers on April 7, 2009.

You can use these websites for a multitude of purposes, but to name a few; you can create websites to manage all of your company documents in a structured manner, provide project management environments, internal company collaboration environments for staff to communicate through using Wiki’s, Blogs, task lists, and much more. There are free templates available for virtually hundreds of different uses.

Document Management with Microsoft SharePoint allows you to pull all of those documents, emails, videos and web pages into one central categorised location and gives you the ability to control version history, access permissions and manage document lifecycle processes. For example, modifications to certain documents must be approved by a manager before being modified, or must be checked by a particular person before going to final draft. Workflows can be designed, so at each stage of a document’s life tasks can be assigned to individuals responsible for them. This is all done through a single point of access, your internal website, Microsoft Office Application or Third Party application and moves away from the cumbersome method of storing all files within shared folders. Document Management allows business to save documents in a final state, satisfying legal requirements for retention of information through the use of a ‘Vault’, once a document reaches a certain age or status it can be automatically shifted into the ‘Vault’ and retained indefinitely.

Project Management within SharePoint provides staff with a feature rich project management application, to schedule key project tasks and deliverables. For anyone who has ever used Microsoft Project before, it will look familiar as it is based on the same software. Staff are given a rich environment within which they can create one or multiple projects, assign tasks to other staff members, schedule key dates and cut-off points, report on progress and track time spent. This can all be tied into Microsoft Outlook with a simple add-in to provide an even richer experience for staff who are already familiar with Microsoft Outlook.

Staff Collaboration within SharePoint provides users with a rich environment within which they can communicate and collaborate with each other. Provide bulletin boards, document libraries, discussion boards, calendars, and announcements for staff to create a rich working environment. Users can collaborate in live environments over Word documents, or presentations. These collaborations can be extended to partners, clients and public facing portals. Provide staff with their own Wiki’s or Blogs, these can be used for staff to track useful information and make it available to other staff members. These technologies extend the investment in existing Microsoft Office applications, and are accessible through a single webpage.

Tie all of these features in with Microsoft Search, which allows you to quickly search through all of your company data for a particular item, content type or topic and you have a very powerful business tool. Microsoft SharePoint Server comes in two flavours, a full blown feature rich version called Microsoft Office SharePoint Server 2007, and a free version with less bells and whistles called Windows SharePoint Server 3.0. Depending on your requirements, the free version may enable you to get that internal website you’ve always talked about up and running doing everything you need, so if you would like to know more, ask your friendly CCL site engineer about which may be best for you.

What is open licensing? Licensing is virtual, confirmation is provided via email.  CCL or the business purchasing the licenses must register the license online, this is when a key is provided.  If you do not have media you must purchase a media CD to install your Office Suite.  Downgrade rights apply.

What is OEM? Original Equipment Manufacturer. This is generally a cheaper way to purchase Office Suites however, it is not transferable.  Ie, if your PC dies or you sell it, it has to go with the machine. OEM is not recorded by Microsoft for auditing. OEM Office products are not suitable for Terminal Server use.
Does not have downgrade rights.

What is boxed product (Buy Now)? It is off the shelf, comes in a box. Boxed product is not recorded by Microsoft for auditing.
Does not have downgrade rights.

What is FPP VUP? Fully Packaged Product Version Upgrade.  This is a boxed product upgrade.  Any FPP version upgrade can upgrade from Microsoft Works 6.0–10; Microsoft Works suite 2000–2006 or later; any 2000–2007 Microsoft Office program or suite; any Microsoft Office XP suite.
VUP’s are not recorded by Microsoft for auditing.
VUP does not have downgrade rights.

PLEASE NOTE: The only way to upgrade your office license to another version is via a VUP or if you purchased Software Assurance with your open license.  SA allows you a maximum of 2yrs of upgrades (plus other benefits). Please see the following link for more information on SA:-

http://www.microsoft.com/licensing/software-assurance/default.aspx

PLEASE NOTE: Where products are not recorded for auditing you will have to provide proof of purchase if audited by Microsoft.

Another feature of Trends Micro’s Message Archiver, is that it can also help manage your email servers workload by reducing up to 80% of emails stored within Microsoft Exchange. An example of this may be to automatically archive emails over 12 months old from Microsoft Exchange into the email archive, or just emails with large attachments, still providing seamless access to these emails, whether they are in Microsoft Exchange, or in the email archive, accessed directly from Outlook. This is of benefit to any organisation where the footprint of Microsoft Exchange needs to be reduced. This is particularly useful on Windows SBS and midsized networks.

Email has become an accepted business record, government and industry regulations increasingly specify that companies must preserve their email records. Lower your risk and increase your productivity with Trend Micro’s Message Archiver. See your CCL Client Relationship Manager for details.

Sun xVM VirtualBox supports any operating system as a guest OS, giving you the flexibility to develop applications on your platform of choice. Which means you can run Windows in a virtual machine on a Mac or Linux platform, or run Solaris OS and Windows applications right alongside Apple applications on your MacBook.

Features & Benefits

Enterprise-class open source desktop and laptop virtualization

• Downloaded by more than 8 million users.
• Licensed in an Open Source Edition under GPLv2.
• Requires no license keys or registration.
• Source code and binaries available for download.

Runs multiple operating systems concurrently on the same computer.

• Hosts: Solaris OS, Windows, Linux, Mac OS X.
• Guests: Supports practically any x86-based OS.
• Enables you to use your platform of choice, eliminating tradeoffs.
• Work concurrently on programs for different platforms simultaneously.

Open APIs and modular design enable customization

• Open architecture exposes APIs via local or remote Web services interfaces.
• Supports both GUI and CLI commands.
• Supports advanced USB devices.
• Ideal for custom solutions or as system components.

High performance virtual machines

• Delivers high-performance virtual hardware for guest operating systems.
• 32-bit and 64-bit guest platforms.
• Enables guest platforms to run at near-native speeds.

Rich host/guest integration

• Guest Additions software enables faster, more seamless virtual experience.
• Seamless windows coexist alongside native host applications.
• Shared Folders move documents and files between host and guest systems.
• Intuitive and natural blend of multiple platforms and applications improves efficiency.

Comprehensive hardware and device support

• Advanced Configuration and Power Interface (ACPI) support shows host power levels.
• VESA Virtual Display Adapter is augmented with custom resolutions.
• NICs support NAT or bridged configurations.
• USB 2.0 with filter control limits which host devices the guest can see.
• Multiscreen resolutions allow guest displays to span monitors.
• 3D graphics acceleration for OpenGL applications on Windows guests.

Remote access to guest virtual machines

• Built-in RDP server provides remote access to virtual machines.
• Delivers boot-level remote access to guests.
• Enables you to access your virtual machines from anywhere.

Snapshots provide state views

• Saves multiple snapshots of the state of virtual machines.
• Lets you easily revert to known good states.

High security architecture

• Military-spec architecture ensures a secure, multi-platformed desktop.
• No interference between virtual machines.
• Zero data leakage between virtual machines.

Enterprise features

• Supports all mainstream Enterprise desktop platforms.
• Supports centralized storage servers via iSCSI.
• Powerful scripting tools to manage virtual machines.
• Enterprise Subscriptions now available delivering the assurance of round the clock support.

Download Sun XVM VirtualBox

Overview

Incorporating various protocols, Aqua Connect Terminal Server makes it possible for diverse workstations and multiple devices to function as thin clients of a Mac OS X server running many Mac® OS X®-based programs. Aqua Connect supports Microsoft RDP, VNC, and X11 protocols.

Key Benefits

Aqua Connect Terminal Server 3.0 makes it possible to deploy most Mac OS X applications across networks quickly at a lower cost. Diverse workstations and RFB-enabled mobile devices function as thin clients, negating the need for numerous OS X application software installations.

Companies and organizations that prefer the Mac OS X platform but are financially committed to existing infrastructure that does not support the Mac OS X Leopard environment can now run many Mac OS X applications cost-effectively simply by implementing an OS X server and Aqua Connect Terminal Server 3.0 software.

Since all configuration files and applications are stored and maintained on one central OS X server, the Aqua Connect Terminal Server significantly reduces IT overhead in the following areas:

• Desktop support
• Maintenance
• Upgrades
• Licensing costs
• Networking costs
• Energy costs & consumption

Features

• Support for existing Mac OS X Leopard 64-bit computers with Intel® architecture
• Remote Administration of terminal services and user accounts enabled via graphical user interface
• Compatible with most RFB-enabled mobile devices as implemented by Virtual Network Computing (VNC)
• Compatible with several X11 thin clients
• Compatible with most RDP thin clients
• Support for numerous simultaneous sessions per server
• Storage and maintenance of configuration files and applications on one central OS X server
• Compatible with Apple Workgroup Manager
• Compatibility with Directory Services

Components

Server Daemons: These background processes enable the Mac OS X server to host multiple, simultaneous client sessions.

Remote Frame Buffer (RFB): Aqua Connect Terminal Server includes an RFB server component that transfers the pixel information of the OS X environment to VNC-enabled clients according to RFB thin-client protocol. By design, RFB protocol makes very few demands on the client environment, so that RFB clients can run on the widest range of hardware with minimal implementation.

X11: Aqua Connect Terminal Server includes an X11 protocol server component that supports client connections using the XDMCP protocol.

RDP: Aqua Connect Terminal Server includes an RDP protocol server component that supports client connections which offer improved user experience by increasing speed and efficiency using the RDP protocol.

Directory Services Integration: Integrates with Directory Services such as LDAP, Open Directory, Active Directory, etc.

Administration Tool: This interface allows you to administer the Aqua Connect Terminal Server remotely. Administrative functions include:

• Authorization of users
• Current sessions
• Ability to audit users
• Terminal options
• Ability to manage administrators (add/delete/change passwords)

System Requirements & Licensing

Server requirements: Aqua Connect Terminal Server will run on any Intel based Macintosh running OS X Leopard Server that meets minimum system requirements. Refer to server documentation available at www.apple.com for details.

On servers with Intel processors, base requirement for Aqua Connect and Mac OS X Leopard server is 512 MB. The recommended minimum free disk space is 500 MB.

Server performance varies on usage patterns and memory requirements of programs used by clients.

Client requirements:

Client sessions require a recommended RAM of 64 MB per session. User sessions also require a minimum of 16 MB of disk space.

Any RDP, X11 or RFB-compatible device can function as an Aqua Connect Terminal Server client.

A Mac OS X Server v10.5 Leopard license is required for simultaneous client sessions. For ten connections, you must purchase one OS X server license. If you wish to support more than ten connections, you must purchase a Mac OS X Server v10.5 Leopard unlimited server license.

For more information, visit http://www.aquaconnect.net or contact the CCL team

Born & bred in sunny Nelson, Jonny McKitrick threw himself into IT from an early age and knew that it was to be his career.

Jonny has been working in the CCL Nelson office for just over a year as a Systems Engineer. Through the year he has spent time working onsite as part of the team in a support role. There have been a number of successful SAN upgrades, Virtual Server installations, deployments and network upgrade projects in the Nelson region which Jonny has been involved in.

As well as holding a Bachelor of Information Technology, Jonny is studying for his MCITP certification and has an interest in IT security which he spends time researching.

Outside of work Jonny enjoys golf, gaming, spending time with friends and throwing himself into adventurous activities while he’s still young enough to bounce back!