Vista Hotfix Packs Leak to Web

Windows Vista hotfixes leak to the Internet after being offered to Windows Server 2008 beta testers this weekend.

Gregg Keizer, Computerworld

Two substantial collections of Windows Vista hotfixes leaked to the Internet after being offered to Windows Server 2008 beta testers this weekend, leading some users to speculate that the pair are actually the foundation of the future Service Pack 1 (SP1) release for the OS.

Labeled "Vista Performance and Reliability Pack" and "Vista Compatibility and Reliability Pack," the two updates feature a long list of non-security-related bug fixes, including those that improve Vista's resumption after sleep or hibernation, boost the speed of copying or moving large directories, prevent some memory corruption problems, bolster the reliability of systems upgraded from XP to Vista and increase compatibility with video drivers.

"These issues have been reported by customers using the Error Reporting service, product support or other means," the two packs' release notes said. "Installing this update will improve the performance and responsiveness of some scenarios, and improves reliability of Windows Vista in a variety of scenarios."

Some Vista users commenting on several of the blogs and forums covering the hotfixes -- a message thread on nVNews appeared to have been the first -- theorized that the packs would be the core of SP1, the service pack Microsoft has been both reluctant to talk about and eager to downplay.

Some of the fixes called out in the release notes seem to point in that direction, since they describe issues and patches already posted to the Microsoft support site. The item pegged as "resolves an issue where a computer can lose its default Gateway address when resuming from sleep mode," for example, is likely the same as an April 24 Vista fix.

The AeroXperience site even posted results of early testing of the packs' performance. According to a write-up here, systems updated with the Vista Performance and Reliability Pack copied large-sized folders in less than half the time as unpatched machines.

As of Monday afternoon, the fix packs were still accessible on at least one non-Microsoft download site. The performance pack update weighed in at 10GB, while the compatibility pack was considerably smaller, at around 2GB.

Although it may seem odd that the fix packs were released to Windows Server 2008 testers, that operating system -- scheduled to launch early next year -- shares code, particularly in the kernel, with Vista.

Microsoft did not reply to a series of questions about the fix packs, whether they are part of an already ongoing test of Vista SP1, or whether they would be issued in an upcoming release from Microsoft Update. The company often uses the one-a-month security patch schedule to also roll out other hotfixes; the next date is Aug. 14, two weeks from tomorrow.

........Thank you http://www.pcworld.com for detail news.......

Microsoft seeks open-source status for its 'shared source' licenses

Exec says vendor will submit them to the Open Source Initiative for certification

July 27, 2007

-- After months of antagonizing the open-source community, Microsoft Corp. now appears to be trying to engage it by seeking an official stamp of approval for the licenses that the company uses to share its own software and source code.

During a keynote speech at the O'Reilly Open Source Convention in Portland, Ore., on Thursday, Bill Hilf, Microsoft's general manager of platform strategy, said that the software vendor is submitting its so-called shared source licenses to the Open Source Initiative for certification as true open-source licenses.

The plans were also detailed on Port 25, a blog written by workers at Microsoft's Open Source Software Lab.

Neither OSI President Michael Tiemann nor Mark Radcliffe, the organization's general counsel, returned e-mails and calls seeking comment on Microsoft's announcement.

Russ Nelson, who chairs the OSI's license approval committee, said via e-mail that he expects Microsoft to submit its shared source licenses for approval within a week or so, but he didn't comment further.

Initial reaction by outside commentators tended toward the positive.

"This is a huge, long-awaited move," Tim O'Reilly, CEO of O'Reilly Media Inc., wrote in his blog. If the shared source licenses are accepted by the OSI, he added, "it will be a lot harder to draw a bright line between Microsoft and the open-source community." O'Reilly Media sponsored the conference at which Hilf made the announcement.

In his blog on CNET Networks Inc.'s Web site, open-source executive and OSI board member Matt Asay said that seeking the group's approval shows that Microsoft "respects the community."

"I welcome this move by Microsoft," Asay wrote. "It continues to impress me as being one of the few big companies that truly understands open source, even if I don't always like how it works with the open-source community."

Zack Urlocker, vice president of marketing at open-source database vendor MySQL AB, also applauded Microsoft's plan in a blog entry on the Web site of InfoWorld, a sister publication of Computerworld.

"Although a bit late to the party, I think this is still a good step on Microsoft's part," Urlocker wrote. "It shows that they appreciate there's a community outside of Microsoft and [that] they are adapting their business practices and licensing in order to be successful there. That, to me, is highly significant."

Microsoft has released 650 internally developed software programs to the general public via its shared source program, according to Hilf.

But don't expect Microsoft to release open-source versions of products such as Windows or Office anytime soon. Most of the products released under the shared source licenses are lesser-known applications hosted on Microsoft's CodePlex site, the company's equivalent to SourceForge Inc.'s popular open-source development site.

Nonetheless, the latest move may come as a surprise to many who have watched Microsoft over the past year. For example, the software vendor has pushed Linux vendors to sign controversial cross-licensing deals in order to avoid any potential legal repercussions from Microsoft's claims that Linux and other open-source products infringe on 235 of its patents.

Microsoft has reached agreements with Novell Inc. and two other vendors, but it was rebuffed by three other companies, including Red Hat Inc. -- raising the specter of a split within the Linux camp.

And Microsoft CEO Steve Ballmer, who once called Linux "a cancer," further fanned the flames last fall by declaring that because of the alleged infringement of the software vendor's intellectual property, "every Linux customer basically has an undisclosed balance-sheet liability."

Microsoft wouldn't be the first vendor not normally associated with open-source technology to have licenses approved by the OSI. Among the 50 or so software licenses that the group has certified are ones submitted by companies such as Apple Inc., CA Inc., Nokia Corp., RealNetworks Inc. and Sybase Inc.

Other OSI-approved licenses include the GNU General Public License and the Mozilla Public License, which is used with the Firefox Web browser.

........Thank you http://www.computerworld.com for detail news.......

Cisco patches Duke's wireless woes

July 25, 2007 (Computerworld) -- Cisco Systems Inc. confirmed today that patches for its wireless LAN controllers released Tuesday arose from the investigation of hot-spot failures at Duke University that were originally pinned on Apple Inc.'s iPhone.

Yesterday, Cisco published a vulnerability alert outlining multiple bugs in its Wireless LAN Controllers (WLC) that it said "could result in a denial of service in certain environments."

According to Cisco, the WLC software's handling of Address Resolution Protocol (ARP) traffic is flawed. ARP, a standard network protocol, is used by devices to sniff out, then map, a wireless router's IP address to its media access control (MAC) network address. That way, a Wi-Fi-equipped notebook can reliably roam from one access point to another -- an important consideration in a campuswide network.

When a Wi-Fi device leaves the range of one hot spot and enters another, it uses ARP to whether it is reacquiring a connection to an access point that it has previously visited. The hardware broadcasts -- Cisco dubs it "unicasts" -- the ARP request to the gateway it had just used.

"A vulnerable WLC may mishandle unicast ARP requests from a wireless client leading to an ARP storm," said Cisco in the advisory. In plain English, that means two or more WLCs start passing massive amounts of ARPs back and forth, flooding the network with unnecessary traffic and crashing the access point.

That's exactly what happened at Duke, where a large number of Cisco-managed hot spots were failing under huge loads, as many as 10,000 ARPs per second, according to Network World. Then, however, Duke blamed the crashes on Apple Inc.'s iPhone, which about 150 people were using on the Durham, N.C., college campus.

"I don't believe it's a Cisco problem in any way, shape or form," said Kevin Miller, assistant director of communications infrastructure at the school's Office of Information Technology.

Two days later, however, Duke CIO Tracy Futhey refuted Miller and said the fault was in Cisco's hardware. Tuesday's patches were the result.

"The advisory is tied to the Duke situation," confirmed Cisco spokesman Neil Wu Becker. "You are right. [There is a] direct correlation here."

But Cisco -- as well as Duke and Apple -- remained mum on how, if at all, the iPhone had been involved, even if innocently. The company's spokesman declined to make a company engineer available or to provide additional details. "We aren't conducting interviews on this matter and instead are pointing to the advisory as a means of providing press and, most importantly, customers, with additional information on how this is resolved, how it can be prevented, etc.," said Becker.

The advisory hints that the new smart phone only triggered the so-called ARP storm. The iPhone, which will automatically connect to wireless access points -- and in any case is constantly scanning for available connections unless its owner has turned off Wi-Fi -- was presumably provoking the bug as it moved from one IP subnet to another. Any wireless device traveling between subnets would have also triggered the storm.

Cisco listed three separate vulnerabilities in the alert but has produced an update only for the newest WLC software, Version 4.1. Controllers running older editions -- 3.2 and 4.0 -- won't receive patches until Friday, said Cisco. In the meantime, network administrators can require all client devices to obtain their IP addresses from a Dynamic Host Configuration Protocol server to protect against accidental ARP storms.

The problem is more than just an inconvenience or embarrassment -- two of the assessments by security researchers and users last week -- but could let hackers make mischief, or worse.

"A malicious wireless user could leverage the issue," noted Symantec Corp. in a warning today sent to customers of its DeepSight threat network. The Cisco-recommended work-around, for example, isn't effective against a deliberate ARP storm attack -- sometimes called "ARP poisoning."

........Thank you http://www.computerworld.com for detail news.......