Posts Tagged Security

SQL Server and FoxPro on September 9 MS Security Bulletin

According to Microsoft’s advanced notification system for security updates, slated to be released on September 9, SQL Server and Visual FoxPro are among the affected software. A webcast will likely be held the day after the bulletin is released. The critical issue has to do with a vulnerability allowing remote code execution.

Specifically, these FoxPro versions as installed on Microsoft Windows 2000 Service Pack 4:

  • Microsoft Visual FoxPro 8.0 Service Pack 1
  • Microsoft Visual FoxPro 9.0 Service Pack 1
  • Microsoft Visual FoxPro 9.0 Service Pack 2

For SQL Server:

  • SQL 2000 Reporting Services Service Pack 2
  • SQL Server 2005 Service Pack 2
  • SQL Server 2005 x64 Edition Service Pack 2
  • SQL Server 2005 for Itanium-based Systems Service Pack 2

Be sure to check out the full report when issued on September 9th if this concerns you (.NET, MS Office, and IE users, you had better have a look too!).

Security Bulletin website

Tags: , , ,

No Comments

FoxPro ActiveX (FPOLE.OCX) Security Bug Fix

In case you haven’t heard, Microsoft released several security updates yesterday — 11, to be exact. One of these patches updates a known issue with VFP regarding FPOLE.OCX. This is what was written in the Washington Post:

MS08-010 fixes a publicly disclosed ActiveX bug that affects Visual FoxPro users. Although hackers have already posted code showing how to exploit this vulnerability, the buggy ActiveX control is not included in Internet Explorer 7’s default list of controls, so the flaw should not affect most users.

You can read more information about this patch (and details about the vulnerability) here: ISS:

The Microsoft Visual FoxPro ActiveX control is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the FoxDoCmd function. By persuading a victim to visit a malicious Web page using Internet Explorer, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim.

More info: http://www.microsoft.com/technet/security/bulletin/ms08-010.mspx

Of course, MS recommends to get patched right away…

Tags: , ,

No Comments

Let Visual FoxPro Check File Permissions

Advisor just put out a great new article titled “Let Visual FoxPro Check File Permissions“. Here is a taste:

Regardless of what one thinks of Windows Vista, without doubt it made developers think about permissions security. Where in the past a user could consider himself lucky when an application at least displayed an Access Denied error message instead of silently failing, we now see developers investigating what permissions and privileges their application really needs. However, Windows doesn’t exactly make this an easy task.

This article was written by Christof Wollenhaup. More from Chris.

Tags: ,

No Comments

HIPAA, PHI and the Patriot Act

Although this isn’t new news, I thought I would bring it up. We had what is called a “lunch-and-learn” session today at work, where the company pays for some pizza and during the lunch hour we al sit around and learn something. Today’s topic was about personal health information (or, PHI). Basically, only certain people under certain circumstances are allowed access to this information. To give you an idea of how strict this is: A husband cannot see his wife’s PHI without her consent. This protection falls under HIPAA.

I asked a question about how the Patriot Act (and Homeland Security) Act changes our rights of privacy in regards to HIPAA. Normally, the most restrictive rules apply. This is the case, for example, with states laws verses federal laws — the more restrictive/protective law takes precedence. But these acts are different.

Therefore, the department of Homeland Security has the authority to seek and obtain your PHI:

“This authority can be interpreted to include requests for PHI of any type without the expressed authorization of the patient or legal guardian. ”

You can read more about this here. Of course the government denies that it will misuse the power, I doubt it. At least this current regime.

Tags: , , , ,

1 Comment