Posts tagged Stephen ramsay

ACER Travelmate 6592 screen fault

Folks, I know I said I would blog more in the new year and I will but in the mean time I just wanted to share an interesting point about my laptop screen.

I have an ACER Travelmate 6592, the power supply blew for it last week and after buying what I thought was a genuine replacement only to find it was a dud, I now have the genuine part (from a different supplier).  I have now started having issues with the back-light of the LCD display, it would hiss and flicker before dieing completely.  I should say this problem occurred on both Windows vista & 7 and on Ubuntu Linux regardless of kernel version.

Thinking the un-clean power from the dodgie replacement power adapter may have damaged the back light bulb I was all for buying a new one and embarking on the daunting task of changing the back-light, until that is I discovered this blog post by Aral Balkan

Running the laptop on mains with the battery in causes screen flicker / black screen, where as running it with just mains or just battery it works fine.

I should also say that if you are running a laptop on mains all of the time you will shorten the life of your battery, therefore removing the battery from all laptops whilst running on mains for a long period of time is not necessarily a bad thing.

The only question is do I want to pay acer to repair my now out of warranty acer travelmate 6592?

Hope this helps some others out there and a massive thanks to Aral Balkan for his blog post.

Adobe update – excessive traffic to ardownload.adobe.com

Adobe has not been without its problems of late, and whilst there have been security issues that could have lead to losses, so far none of our clients have suffered financially from Adobe’s failings.  Until now that is.

One of our Clients had their ADSL cut off this week as they had exceeded the usage policy.   Why?  Adobe Update Manager on one Windows XP PC had decided to download over 70GB of data over the course of a 7 day period.  It would appear that it was getting itself in a loop and just kept trying to update continuously, 70GB worth of continuously.

The Adobe website serves the update MSI binary files as content type Text/Plain, the Adobe Update client has a very short timeout and immediately opens another connection to re-start the download.  Hence if there is a slow connection or the caching server does not return the whole file in a timely manner the Adobe Update client enters the infinite loop of retries, causing the excessive bandwidth consumption witnessed here.

There are several forum threads including on Adobe’s own site http://forums.adobe.com/thread/392129 all linking this issue to a conflict between and old version of WebMarshall and Adobe updater; however our machines do not use WebMarshall and we do not have it installed anywhere on our networks.

We do however use Squid caching on our CentOS 5 servers.  The server in this instance seems to be fulfilling the requests on each occasion in a timely manner  – the issue is that each time Adobe updater passes a URL it is different in key areas, which Squid interprets as a separate request.  This is not abnormal and we have seen this before when we have tried to configure squid to cache Windows updates.  However rather than enter a loop of requests, Windows updates simply fail.  Other automatic updaters work well with caching systems and indeed most ISPs are now implementing different forms of web caching on their own networks.  Dose this mean the Adobe issue is affecting them in the same way?

The issue seems to only affect PCs (or at least we have seen no affected Mac users as yet), and it also seems to affect most Adobe products.

For now Adobe and the ISPs have remained quiet on the issue, however we have 3 other clients (and my own home ADSL ) who cannot update Adobe at all, access to ardownload.adobe.com appears to have been blocked by the ISP.  Quite when the Adobe update issue will be resolved is unknown; however we have also taken the decision to block access to ardownload.adobe.com from all of our networks, for the moment.

Richard, one of our Systems Admin Team has published a more detailed account of the technicalities involved here: http://richard.blog.kraya.co.uk/2009/12/16/a-big-adobe-problem/

Its been a while………

It has been a while since I posted to my blog – sorry about that.

There have been a number of reasons:  Firstly, things have been very busy here at krayatec and more importantly, Angela and I got married.  Thanks to all who came to our wedding and I do hope you all had a good time.  We certainly enjoyed ourselves and I’m glad to report that after his wee trip to hospital my grandfather is well; one operation over and waiting on his second.

So what’s been happening around here?

Due to family illness Andrei has decided to return to Canada, so we are now recruiting for his position.  To help cover while we recruit a replacement, David will shortly return for Christmas, it’ll be nice to have him back for a while.

We have had some new clients come on stream in the last few months and have seen an large increase in the number of computers covered  via our existing clients.

With the VAT changes coming to an end this month, we have also seen a number of large hardware purchases as people seek to take advantage before the VAT rate returns to 17.5%.

There has been lots of other exciting news, some of which I will blog about over the next few months and some of which is already on twitter.

As we approach Christmas, I have also been thinking about new year’s resolutions and well, along with the usual ones like diet and putting the toilet seat down (can’t believe how much that annoys her – such a cliché! ), I have made myself a work resolution to Blog at least once a fortnight and tweet once a day.

We’ll see how I get on… As always, comments welcome.

Krayatec are Hiring

Are you a geek at heart looking for your first Real IT job?

Do you have what it takes to join the krayatec team?

Krayatec are currently looking for a Junior IT Support Engineer, to join our team. This is an opportunity for someone with a good general IT and computing skills who is looking for one of their first jobs in IT. Qualifications are not top of our wish list, most important of all is the right attitude and aptitude, someone who is articulate with good customer service skills. They must be a quick learner with good problem solving skills and a great telephone manner.

Krayatec is not your run of the mill IT Company and we’re not looking for a run of the mill person.

To tell us why you’re as unique as we are and apply, or for more information and to read the formal job Advert please see http://www.krayatec.co.uk/careers/

For more info on Kraya see http://www.kraya.co.uk/

Stephen Ramsay
Head of Krayatec

Update I have added an Application Closing Date of 9am, Friday 14th August 2009

Changing your password in Kerio Mailserver

Changing your passwords is very easy.

Under your Windows computer press Crtl + Alt + Del and select change password.

To Change your email password, simply log into your Web Mail  (call us if you don’t know the address)

Then Select change password from the Settings drop down menu as below

settings menu in  kerio webmail

settings menu in kerio webmail

And then enter your old and new passwords in the box below.

kerio password change dialog box

kerio password change dialog box

Remember to make it something secure that no one will guess, no kids, partners or team names and no dictionary words. Random Numbers and letters, remember capitals and lower case combinations are best, or try a sentence like “Why can 1 never remember 555″ you can use spaces. Remember the best passwords are not necessarily easy to remember but they can be if your clever about it.  Hackers offten use  a dictionary or password list attack  to crack passwords, this is where a system tires every word in the dictionary or in a common password list, things like Rangers, Rang3rs or Celtic, C3lt1c will be near the top of that list.

Kerio Mail Server – Feedback and Updates

Kerio have recently introduced a new update for the Kerio MailServer (KMS), which has fast become krayatec’s favoured mail server.

We have now deployed Kerio MailServer 6.2 to most of our clients and despite a handful of teething problems, most are now seeing advantages over Exchange and their previous IMAP based systems.

Feedback from clients has generally been positive, however for two of our clients the switch has not been as pain free as we would have liked and they are still experiencing several issues:

  • VERY Slow connections between the Kerio Outlook connector and the Server.
  • Kerio Outlook Connector seems to consume huge amounts of RAM, particularity on older Systems.
  • Outlook and MS Word Mail merge function seams to fail after installation of Kerio Off-line Outlook connector.  This issue is still under investigation by both our own and Kerio’s Technical teams.
  • IMAP sync issues when using Thunderbird: Kerio and Thunderbird seem to be unable to share junk, sent and deleted folders leading to duplication.
  • Thunderbird and Kerio integration is not perfect in general and Thunderbird is unable to feed back junk mail training data, or rule learning, to the Kerio Mail Server.

The release notes for the new Update to Kerio MailServer 6.7 suggests that this upgrade will fix most of these issues.  The update has now been deployed to our own Kerio system and we are currently testing this in full prior to deployment to our clients systems.  After discussing the updates with the Kerio team, we are very hopeful of resolving the above issues. However, it is indisputable that issues may remain with legacy systems, particularity Windows 2000.

Feedback / comments and suggestions for the above issues are always welcome.

Security Bulletin – Adobe Reader and Acrobat

Below is an update to Security Bulletin – Adobe – April 09

Adobe have published a new Security Bulletin and provided updates for Adobe Reader and Acrobat patches. These updates resolve the previously reported vulnerabilities in Adobe Reader 9.1 and Acrobat 9.1 and earlier versions. This vulnerability (CVE-2009-1492) would cause the application to crash and could potentially allow an attacker to take control of the affected system remotely and install Malicious code.

We have already recommended that user consider using alternatives to Adobe reader, this continues to be our current advice. However users still using Adobe should now update and install these patches as soon as practical.

Adobe recommends users of Adobe Reader 9.1 and Acrobat 9.1 and earlier versions update to Adobe Reader 9.1.1 and Acrobat 9.1.1. Adobe recommends users of Acrobat 8 update to Acrobat 8.1.5, and users of Acrobat 7 update to Acrobat 7.1.2. For Adobe Reader users who can’t update to Adobe Reader 9.1.1, Adobe has provided the Adobe Reader 8.1.5 and Adobe Reader 7.1.2 updates.

Apple Security Update

Apple have today issued a massive set of security updates for Mac OS X update to correct total of 67 security vulnerabilities. The unexpected and abrupt Apple Patch issue also includes patch to fix a number of security flaws in Safari Web browser on both Mac OS X and Microsoft Windows.

The OS X update fixes security vulnerabilities and flaws in a total of 31 different Apple components, including issues in open-source packages used by Apple. The updates also fix code execution vulnerabilities in several pieces of apple software. These are very similar to the vulnerabilities seen in Adobe and Microsoft products.

The detailed list of affected software, components is shown below and more information can be found on Apple’s support site. For ease of understanding I have combined a few of these into one.

An Important phrase you will get to know is ” may lead to execution of malicious code” this essentially means attackers could run a program on your computer that allows them to, well do anything they like, from taking note of your bank details to reeking havoc with your system configuration.

APPLE-SA-2009-05-12 Security Update 2009-002 / Mac OS X v10.5.7

Apache CVE-2008-2939
Affected: Mac OS X v10.4.11, Mac OS X Server v10.4.11
Details: An input validation issue exists in Apache’s handling of FTP proxy requests containing wildcard characters. Visiting a malicious website via an Apache proxy may result in an attack.

Apache CVE-2008-2939
Affected: Mac OS X v10.5, v10.5.6 & Mac OS X Server v10.5, v10.5.6
Details: Visiting a malicious website may allow an attack to run a malicious program.

Apache CVE-2008-0456
Affected: Mac OS X v10.5, v10.5.6 & Mac OS X Server v10.5, v10.5.6
Details: Web sites that allow users to control the name of a file may be vulnerable to redirection the user to a different file without the users knowledge by forging the malicious file name. Thus tricking users into opening malicious content.

ATS CVE-2009-0154
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Viewing or downloading a document containing a maliciously
crafted font may lead to execution of malicious code.

BIND CVE-2009-0025
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: BIND is susceptible to a spoofing attack, were one website pretends to be another, if configured in a certain way using OpenSSL. A maliciously crafted security certificate could bypass the validation, which may lead to a spoofing attack.

CFNetwork / Safari CVE-2009-0144
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: Safari and other Applications that use CFNetwork may send secure cookies unexpectedly over a unencrypted connection. Systems prior to Mac OS X v10.5 are unaffected.

CFNetwork / Safari CVE-2009-0157
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: Visiting a malicious website may lead to an application terminating unexpectedly or malicious code execution. Systems prior to Mac OS X v10.5 are not affected.

CoreGraphics CVE-2009-0145, CVE-2009-0155
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Opening a maliciously crafted PDF file may lead to an application terminating unexpectedly or malicious code execution.

CoreGraphics CVE-2009-0146, CVE-2009-0147, CVE-2009-0165
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Viewing or downloading a PDF file containing a maliciously crafted JBIG2 stream may lead to an application terminating unexpectedly or malicious code execution.

Cscope CVE-2009-0148
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Processing a maliciously crafted source file with Cscope may lead to an application terminating unexpectedly or malicious code execution.

CUPS CVE-2009-0164
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Visiting a maliciously crafted web site may lead to unauthorized access of the Web Interface of the printing service. This may allow a maliciously crafted website to start and stop printers, and access information about printers and jobs and even print documents.

Disk Images CVE-2009-0150, CVE-2009-0149
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Mounting a maliciously crafted disk image may lead to an application terminating unexpectedly or malicious code execution.

Enscript CVE-2004-1184, CVE-2004-1185, CVE-2004-1186, CVE-2008-3863
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Multiple vulnerabilities in enscript which may lead to malicious code execution.

Flash Player plug-in CVE-2009-0519, CVE-2009-0520, CVE-2009-0114
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Multiple issues exist in the Adobe Flash Player plug-in, when viewing a maliciously crafted web site these may lead to malicious code execution.

Help Viewer CVE-2009-0942, CVE-2009-0943
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: A maliciously crafted Apple “help:” page may be used to invoke AppleScript files, which may lead to malicious code execution.

Ichat CVE-2009-0152
Affected: Mac OS X v10.5 – v10.5.6,Mac OS X Server v10.5 – v10.5.6
Details: iChat can use Secure Sockets Layer (SSL) for AOL Instant Messenger and Jabber accounts. If iChat is unable to connect it will authenticate via plain text (non secure) methods until SSL is manually re-enabled. A remote attacker with the ability to observe network traffic may observe the contents of AOL Instant Messenger conversations.

International Components for Unicode CVE-2009-0153
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: Maliciously crafted content may bypass website filters and result in malicious code execution.

IPSec CVE-2008-3651, CVE-2008-3652
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Multiple vulnerabilities and memory leaks exist in the racoon daemon in ipsec-tools which may lead to a denial of service.

Kerberos CVE-2009-0845, CVE-2009-0846, CVE-2009-0847, CVE-2009-0844
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: An attacked could send maliciously crafted authentication information or an encoded message which may lead to a denial of service of a Kerberos-enabled program

Kernel CVE-2008-1517
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: An issue exists which may lead to a local user obtaining system privileges or to an unexpected system shutdown. This vulnerability may also allow malicious code execution with Kernel privileges.

Launch Services CVE-2009-0156
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Downloading a maliciously crafted Mach-O executable (application) may cause Finder to repeatedly terminate and relaunch.

Libxml CVE-2008-3529
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Visiting a maliciously crafted website may lead to an application terminating unexpectedly or malicious code execution.

Net-SNMP CVE-2008-4309
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: A remote attacker may terminate the operation of the SNMP service by sending specificity crafted messages.

Network Time CVE-2009-0021, CVE-2009-0159
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Network Time is susceptible to a spoofing attack if NTP authentication is enabled. Once spoofing has take place a remote NTP server could maliciously execute code.

Networking CVE-2008-3530
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: When IPv6 support is enabled, A remote user may be able to cause an unexpected system shutdown.

OpenSSL CVE-2008-5077
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: An attacked could use a man-in-the-middle attack and be able to impersonate a secure trusted server or user in applications using OpenSSL for SSL certificate verification. Permiting an attacker to capture information the user thought was secure.

PHP CVE-2008-3659, CVE-2008-2829, CVE-2008-3660, CVE-2008-2666,CVE-2008-2371, CVE-2008-2665, CVE-2008-3658, CVE-2008-5557
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: Multiple vulnerabilities in PHP which may lead to malicious execute code.

QuickDraw Manager CVE-2009-0160, CVE-2009-0010
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Opening a maliciously crafted PICT image may lead to an application terminating unexpectedly or malicious code execution.

Ruby CVE-2008-3443, CVE-2008-3655, CVE-2008-3656, CVE-2008-3657, CVE-2008-3790, CVE-2009-0161
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: Multiple vulnerabilities exist in Ruby 1.8.6 including the fact that Ruby programs may accept revoked or invalid security certificates as genuine.

Safari CVE-2009-0162
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: Multiple input validation vulnerabilities exist in Safari’s handling of “feed:” URLs. Accessing a maliciously crafted “feed:” URL may lead to malicious code execution.

Spotlight CVE-2009-0944
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Downloading a maliciously crafted Microsoft Office file may lead to an application terminating unexpectedly or malicious code execution.

system_cmds
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: The “login” command starts an interactive shell after a local user is authenticated. The priority level for the interactive shell is reset to the system default, which can cause the shell to run with an unexpectedly high priority and authorization level.

telnet CVE-2009-0158
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Connecting to a TELNET server with a very long canonical name in its DNS address record may lead to an application terminating unexpectedly or malicious code execution.

WebKit CVE-2009-0945
Affected: Mac OS X v10.5 – v10.5.6, Mac OS X Server v10.5 – v10.5.6
Details: Visiting a maliciously crafted website may lead to an application terminating unexpectedly or malicious code execution.

X11 CVE-2006-0747, CVE-2007-2754, CVE-2008-2383, CVE-2008-1382, CVE-2009-0040
Affected: Mac OS X v10.4.11 – v10.5.6, Mac OS X Server v10.4.11 – v10.5.6
Details: Multiple vulnerabilities exist in FreeType v2.1.4 & v2.3.8, the most serious of which may lead to an application terminating unexpectedly or malicious code execution when processing a maliciously crafted font. Displaying maliciously crafted data within an xterm terminal may also lead to malicious code execution. Further vulnerabilities exist in libpng version 1.2.26, the most serious of which may also lead to arbitrary code execution.

Security Update 2009-002 / Mac OS X v10.5.7 may be obtained from the Software Update pane in System Preferences, or Apple’s Software Downloads web site: http://www.apple.com/support/downloads/

The Software Update utility will present the update that applies to your system configuration. Only one is needed, either Security Update 2009-002 or Mac OS X v10.5.7.