NVDi Support News & Alerts » Software Updates

Office 2007 Service Pack 2 released

wkwalker — Wed, 29 Apr 2009 17:35:03 +0000

Office 2007 Service Pack 2 was released yesterday. It’s a big download — 290MB if you grab the whole thing — but worth it. For most folks, the biggest reason to get it is that a number of Office applications load and run noticeably faster. SP2 also rolls up a great many security and bug fixes and incorporates support for Open Document Format (ODF). ODF is an important, non-Microsoft document standard and the default format used by third-party packages such as Open Office. This is no more than a convenience for most small operations, but is a big deal for organizations with significant cross-platform or international exposure.

How to get it…

If you have automatic updates enabled and set up to download more than just core Windows updates, you should be offered Office 2007 SP2 automatically.
You can download it directly from Microsoft.
Or, you can get SP2 from a third party such as BetaNews fileforum.

So far, the SP2 update seems to be pretty well behaved. It reset my default news reader setting, but that was a minor irritation, easily corrected. If I encounter any significant issues, I’ll post them here.

Oh, one more thing: If you are running Windows XP, you must have Service Pack 3 installed before you can install Office 2007 SP2. For Vista, Service Pack 1 is required.

Alert: More Adobe Reader flaws surface

wkwalker — Wed, 29 Apr 2009 01:52:19 +0000

Here we go again.

Security researchers have turned up a couple more vulnerabilities in Adobe Reader (and Adobe Acrobat for those of you running the full, pay-for package). These flaws permit running arbitrary code on a target system without the user’s knowledge. This is triggered by tricking a victim into opening a maliciously crafted, JavaScript-enabled PDF document — typically, an email attachment or a document served up on an infected web site.

First off, ensure Adobe Reader/Acrobat is up to date. This will plug the holes fixed in the last round of updates. Check the Adobe Reader (or Acrobat) version by clicking on the Help menu and then choosing “About…” (If there are two “About” options, use the one that refers to Reader/Acrobat, not the one that says something about plug-ins.) For Reader 9 and Acrobat 9, the version displayed should be 9.1 or later; for Reader/Acrobat 8, it should be at least 8.1.3.

If the program is out of date, the easiest way to fix this is to again select the Help menu, but choose “Check for Updates…” This will download and install the appropriate updates.

For versions older than 8, it’s time to upgrade to the latest release.

Next, disable Adobe Reader/Acrobat JavaScript. Launch the program, click on the Edit menu and select “Preferences…” In the left pane of the Preferences window, choose “JavaScript”; to the right, near the top, un-check (clear) the box labeled “Enable Acrobat Javascript”. Click OK.

Even after this next round of bugs is patched, it is probably best to leave JavaScript disabled. It’s a potential vulnerability and rarely, if ever, used.

Patch Tuesday looms

wkwalker — Fri, 10 Apr 2009 23:35:52 +0000

April 14th is “Patch Tuesday.” Barring a major panic, Microsoft issues security updates for its products on the second Tuesday of the month. This month, we’re looking at eight patches, five of them rated “critical.” Microsoft’s offical security bulletin has all the details they’re willing to share so far.

It’s generally a good idea not to let security updates slide for very long. Once the word is out, the bad guys try to reverse-engineer the patches. If they find anything particularly juicy, they take advantage of the fact that many people are remiss about applying the patches. For instance, the primary mode of infection used by the currently infamous Conficker worm is a vulnerability that was fixed several months ago.

A little side-note: April 14, 2009 is also the day Windows XP goes on “extended support.”

Alert: Make sure Adobe Reader/Acrobat is up to date

wkwalker — Wed, 08 Apr 2009 06:43:16 +0000

Adobe recently released updates to Adobe Reader and Adobe Acrobat to fix a flaw that permitted running arbitrary code on a target system without the user’s knowledge. This is triggered by tricking a victim into opening a maliciously crafted PDF document — typically, an email attachment or a document served up on an infected web site.

Check the Adobe Reader (or Acrobat) version by clicking on the Help menu and then choosing “About…” (If there are two “About” options, use the one that refers to Reader/Acrobat, not the one that says something about plug-ins.) For Reader 9 and Acrobat 9, the version displayed should be 9.1 or later; for Reader/Acrobat 8, it should be at least 8.1.3.

If the program is out of date, the easiest way to fix this is to again select the Help menu, but choose “Check for Updates…” This will download and install the appropriate patches.