Buffer overflow vulnerability in Lotus Notes file viewer for Lotus 1-2-3 attachments

Technote 1285600:

Question

Sebastián Muñiz from the CORE IMPACT Exploit Writers Team (EWT) at Core Security Technologies contacted IBM® Lotus® to report a potential keyview buffer overflow vulnerability in Lotus Notes® when viewing a Lotus 1-2-3 (.123 extension) file attachment. In specific situations it was found that the possibility exists to execute arbitrary code. To successfully exploit this vulnerability, an attacker would need to send a specially crafted Lotus 1-2-3 file attachment to users, and the users would then have to double-click and View the attachment. The advisory will be available at the following URL: http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=2008

Answer

This issue was reported to Quality Engineering as SPR# PRAD777KP, and we have received a software update from the technology vendor involved. You must contact IBM Support to obtain the patch, which is available for Notes 7.x and 8.x client versions. Note: The issue impacts only Windows-based Notes clients; it does not impact the Domino server. Workarounds for Notes 7.x and 8.x client versions: Option 1: Contact IBM Support to obtain the patch for the Notes client. Option 2: Alternately, you can disable the affected file viewer by following one of the options in the "How to disable viewers within Lotus Notes" section of this technote. Workaround for Notes 6.x client versions: We are currently working with the technology vendor involved to investigate options for the Notes 6.x client versions. This section will be updated with more information by November 30th. Until a final solution is determined, you can disable the affected file viewers by following one of the options in the "How to disable viewers within Lotus Notes" section of this technote. Workaround for Notes 5.x client versions: If you are interested in protecting yourself from this vulnerability, we recommend disabling the viewers as described in the "How to disable viewers within Lotus Notes" section of this technote. There is no software fix available for the Notes 5.x client version. How to disable viewers within Notes: Option 1 : Delete the keyview.ini file in the Notes program directory. This disables ALL viewers. When a user clicks View (for any file), a dialog box will display with the message "Unable to locate the viewer configuration file." Option 2 : Delete or rename the problem DLL file, which in this case is l123sr.dll. Be aware that the DLL file name starts with lowercase "L". When a user tries to view a 123 spreadsheet file type, a dialog box will display with the message "The viewer display window could not be initialized." All other file types work without returning the error message. Option 3 : Comment out specific lines in keyview.ini for any references to the problem file (dll). To comment a line, you precede it with a semi-colon (;). When a user tries to view the specific file type, a dialog box will display with the message "The viewer display window could not be initialized." For example: [KVWKBVE] ;81.2.0.5.0=l123sr.dll ;81.2.0.9.0=l123sr.dll Additional Background In general, users are strongly urged to use caution when opening or viewing unsolicited file attachments. The attachments will not auto-execute upon opening or previewing the email message; the file attachment must be opened by the user using one of the mentioned file viewers. In some cases, further user action is also required to trigger the exploit.

via Computerworld

unsubscribe from terror

Governments take for granted that you support their actions in the
war on terror. The truth is you’ve never been given a choice. Until now.

This is your chance to say NO, I didn’t sign up to a world governed by fear
culture & accepting of racial discrimination. I didn’t sign up to secret detention,
torture, rendition and the ill treatment of prisoners at Guantanamo Bay.

Most petitions ask you to add your name to a list; this one asks you to take it off.

via woonjas

Lotusphere websites oddity

I left for vacation on November 9th. I come back to find this in my Inbox:

Date: Tue, 13 Nov 2007 13:19:07 -0500 [11/13/2007 06:19:07 PM America/New York]

The Lotusphere Content Team would like your input on final content
direction for Lotusphere 2008...

A couple of paragraphs later it goes on to say this:

Deadline to submit your preferences and BoF vote is November 23, 2007

Umm.. okay... so roughly 10 days to provide feedback? That seems a little short to me, but I guess the show must go on. I'm honestly a little ticked off since I purposefully registered early just so I could provide my input.

Anyway, I didn't get back from vacation until November 25th but I decided to try logging in anyway. I did this because the session abstract submission is still active so I figured the preferences app would probably still be up as well. It is, and it accepted my selections even though the breakout sessions list is already finalized.

This isn't a complaint so much as an observation. The devil is in the details, and this is yet another example of where IBM drops the ball. Instead of letting people submit abstracts and preferences after the deadline it should give a "Thanks for your interest, voting/submissions are closed" message. In typical megacorp fashion, they leave the user in limbo wondering whether their submission was actually processed.

back from vacation

I'm back from Barcelona and the cruise and catching up on the real world. Pictures and a writeup to follow soon. Here is a brief rundown: Barcelona scares me, the Azores are beautiful, northerly transatlantic crossings suck, and a ship captain should have just as much responsibility to his passengers as his home office.

Lotusphere Over the Rainbow group back for 2008!

At Lotusphere 2007 someone reached out and made the first ever attempt to organize gatherings of GLBT attendees at Lotusphere. Or the first I know of anyway. It was a blast and we had a great time, so I spoke with last year's organizer about repeating it for Lotusphere 2008. We agreed we would like to publicize the group better for 2008 and organize things a little better.

To that end I created a Google Group: LSOverTheRainbow. Membership is open to everyone and you can choose to participate or not, as little or as much as you like. Once you join you can send invitations from the group to any of your friends. I didn't lock down postings or set them to be moderated, so have at it.

For the record, please don't think I or anyone else is the leader of this group. This is just a convenient place to congregate and an easy way to disseminate information. So post a discussion, start a conversation, meet some new people, and make the most of networking at Lotusphere. :-)

Everyone is welcome but please understand this is a group targeted at gay, lesbian, bisexual and transgendered people. If you have an issue with any of those groups you probably shouldn't join. :-)

Blue Ginger

When we went to Boston recently we booked our flights around when we could get reservations at Blue Ginger in Wellesley, MA. Blue Ginger is the restaurant of Ming Tsai, a chef of Chinese descent who grew up in Dayton, OH cooking with his parents in their restaurant. Ming is best known for his show East Meets West on Food Network, as well as Simply Ming on Public Television.

I started off with a peach Manhattan, and Myron had a house special concoction I didn't write down. :-( Both were excellent, and I'm now on a mission to find a good peach liqueur so I can recreate the Manhattan.

When we finally had to make decisions from the menu we were seriously torn. We wanted one of each! For appetizers we finally we settled on the tuna poke, which was sublime, and the foie gras shui mai. The shui mai were tasty but the dumpling wrappers were rubbery, gummy and sticky all at the same time. The sauternes and shiitake broth they were served with was an amazing combination of flavors.

I selected the Chile Tea Rubbed Duck Breast with Fresh Plum Sauce and Peach Teriyaki as my entree and Myron had the Sake-Miso Marinated Alaskan Butterfish, which is one of Ming's signature dishes. My duck was rubbed with smoked paprika, cayenne, and sugar and served with a johnny cake topped with duck leg confit and a small bed of baby watercress. It was served a perfect medium rare, and the flavors exploded. My mouth was tingling nicely all the way through dinner. The duck confit and the johnnycake could have stood up on their own as an appetizer. The confit was meltingly succulent, the johnnycake had a firm texture and a wonderful corn flavor.

Myron's butterfish was cooked to perfection, and the delicate flavors all balanced well. Everything on the plate enhanced the flavor in a delightful way. The soba noodle sushi was very tasty, but the texture of the nori was an odd counterpoint to the butterfish.

The wine list was relatively small at seven pages and still managed to offer a lot of variety. The prices, though, where astronomical. Wines I can buy for $10 were priced over $50. Wines I had purchased in other fine dining restaurants for $45 were $80 here. I expected it to be expensive, but that was just absurd. We opted for a glass of wine each and were pleasantly surprised when we were given a small decanter that contained enough to fill each of our glasses twice. I chose the d'Arenberg Shiraz, Myron had the Fairview Sauvignon Blanc. Both were delicious and paired well with our main courses.

The food at Blue Ginger is absolutely sublime and rivals the finest restaurants I have been to anywhere in the world. However the decor leaves a lot to be desired. The restaurant is located in a converted retail space in a section of storefronts in Wellesley, MA, about 20 minutes from Boston. When you walk in the open kitchen is to your right, down the length of the restaurant, and a small bar area is to your left. The first thing that struck me were the support columns. The columns are built out about 3 food square and trimmed in light blonde wood. The tops angle out, making them look like inverted coat racks. The white and light colored wood is repeated throughout the restaurant. The floor is covered in nondescript institutional vinyl tile. With all the surfaces being so hard, and the kitchen open to the dining room, the result is an extremely noisy environment.

The odd decor and the noise were our only complaints about Blue Ginger. Dinner for two was pretty pricey and I expected something a little nicer than what Blue Ginger offered. I'm glad I had the experience, but I'm not sure I'd go back.

on vacation

My last couple of trips have been for weddings, but now I'm finally taking a real vacation! This is the final stop in my year of insane travel. We're flying to Barcelona on Friday, November 9th (landing on Saturday the 10th), then getting on the Oceania Regatta for a 12 day transatlantic cruise on Tuesday, November 13th. I'll be in Bermuda on Thanksgiving Day. :-)

	Day		Port	Arrive			Depart
	1		Barcelona, Spain				5:00PM
	1		Barcelona, Spain		5:00PM
	2		Cruising the Mediterranean Sea
	2		Cruising the Mediterranean Sea
	3		Cruising the Atlantic Ocean
	3		Cruising the Atlantic Ocean
	4		At Sea, International Waters
	4		At Sea, International Waters
	5		Ponta Delgada (Azores), Portugal	8:00AM			4:00PM
	5		Ponta Delgada (Azores), Portugal	8:00AM	4:00PM
	6		Cruising the Atlantic Ocean
	6		Cruising the Atlantic Ocean
	7		Cruising the Atlantic Ocean
	7		Cruising the Atlantic Ocean
	8		Cruising the Atlantic Ocean
	8		Cruising the Atlantic Ocean
	9		Cruising the Atlantic Ocean
	9		Cruising the Atlantic Ocean
	10		St. George, Bermuda	8:00AM			4:00PM
	10		St. George, Bermuda	8:00AM	4:00PM
	11		Cruising the Atlantic Ocean
	11		Cruising the Atlantic Ocean
	12		Cruising the Atlantic Ocean
	12		Cruising the Atlantic Ocean
	13		Miami, Florida	7:00AM

I plan to relax a lot and recharge. Thanks to Vitor Pereira for helping us plan our day in the Azores.

a perfect fit

This past weekend I installed my new Sharp Aquos LC52D64U in my den. I measured obsessively to make sure it would fit between the counter top and the bottom of the bookshelves. This replaced an older 54" rear projection TV that ate 1/3rd of the den. Instead of the incredibly expensive Sharp mounting bracket I purchased a Rosewill mounting bracket from Newegg. It's been up since Saturday with no problems. And yes, that's the Food Network on screen. I was watching Throwdown with Bobby Flay. :-)

Believe it or not, this was very much an impulse purchase. Bruce Elgort sent me an e-mail inviting me to participate in a friends and family promotion from his employer, and it was a deal too good to pass up. We love the TV and the space it allowed us to reclaim, so thanks Bruce!

Just in case you wonder about the dated look of the paneling, our house was built in 1955 and the paneling and the built-in book cases and cabinets are all original. It's thick knotty pine, which is hard to find these days that hasn't been painted. It's not a look everyone likes, but we do. I redid the ceiling about two years ago, stripping off the popcorn / cottage cheese texture and painting it a color called Melted Butter, then doing the 6" stripe of a color called New Penny. The weird thing sticking down at the top of the picture is the bottom of a ceiling fan. Every room in our house has a ceiling fan, we couldn't survive the summer without them.

Killer Presentation Skills

Just to show I'm not a sore loser, here is something for the people who were chosen to speak at Lotusphere.

Lotusphere 2008 speaker selection is complete

Thank you for submitting an abstract for consideration for Lotusphere 2008.
Unfortunately, we are unable to accept your session submission -- we
are simply unable to accommodate all of the incredibly 'top-notch'
submissions. We truly appreciate the amount of time and energy you
put into writing your session proposal - this was a year of extremely
tough decisions!

We thank you for your interest, and look forward to seeing you in
Orlando in January!

Sincerely,

The Lotusphere 2008 Content Team

Oh well. There is always next year. This just means I'll have more time to socialize. :-)

Last day for early bird Lotusphere pricing

I meant to post this earlier, but I've been a little busy. Today is the last day to register for Lotusphere 2008 at the low, low price of $1895! Even without the CLP love (yeah, I'm still ticked about that) it's still a good deal. Where else can you get a week of training, attend amazing events -- I mean come on... they rent a Disney theme park for an evening! -- and hang out with amazing people?

worst ... week ... ever!

The following is a total rant. I've just got to get this out.

Recently I blogged about our Exchange server getting toasted. That was just a warm up. Here is the timeline of the ongoing catastrophe.

• Monday October 7th, 2007 - New network administrator starts.
  
  
• Friday October 12th, 2007 - Old network administrator's last day. I'm in Boston. A problem is reported with files not updating on a DMZ server. Together with the new network administrator they determine it was an issue with SQL Server replication. They reinitialize the replication snapshot in such a way that it kills the security on the destination database and prevents customers from accessing it.
  
  
• Monday, October 15th, 2007 - I walk into the SQL Server replication mess and work on getting that cleaned up. The actual problem was a firewall rule they changed that was blocking FTP uploads to the DMZ server. Meanwhile, new network administrator is busily installing software which he says will help him document our infrastructure. This, in turn, installed .Net 3.0, which requires a reboot. He doesn't restart because it's the middle of the work day. The cluster services on our SQL Server and Exchange boxes to go haywire.
  
  New network administrator doesn't notice the services failing and proceeds to install all outstanding Windows Updates on all servers. He also installs Internet Explorer 7 on all of them, even the DMZ server which didn't even have IE installed at all for security reasons.
  
  
• Wednesday, October 17th, 20007 - The cluster failures are affecting user productivity. The PC Tech notices there are amber and red lights flashing on the drive arrays for Exchange and SQL Server. Exchange flambe (linked above) ensues. New network administrator earns the title Retarded Network Monkey (RNM). Restoring Exchange and rebuilding mailboxes takes the better part of a week.
  
  While this is going on there are weird problems with ISA and IIS servers. It turns out that while all the environment is horribly unstable RNM continues patching servers. One patch on the DMZ server takes our customer-facing ASP.Net 1.1 website offline. It takes nearly two days of research before my boss finds and fix the problem. I'm fixing SQL Server replication again after another patch kills it.
  
  
• Tuesday, October 30th - Guess what? More patches are applied. SQL Server replication breaks again. Our ISA server goes bonkers and won't route outbound traffic. ISA rules are implemented with no rhyme or reason in an attempt to route traffic through a secondary connection.
  
  We finally have our first departmental meeting to discuss the problems we have been having. RNM makes it clear he doesn't think he had anything to do with any of the problems. He mentions he's in the middle of applying patches to the DMZ server and our SQL Server cluster. In the middle of the work day. Again. I bite my tongue until it bleeds. We come up with a change control process and a new edict: NO NEW PATCHES until everything we have is stable.
  
  
• Thursday, November 1st - I finally have SQL Server replication rebuilt and stable. Users report that files they FTP to the DMZ server aren't showing up. It turns out the rules implemented on Tuesday broke FTP, but it's also eating the response so the clients think they files are going through. This is the same rule that was first implemented on October 12th. RNM decided to re-enable it, but added the nice touch of not providing any error messages this time.
  
  
• Friday, November 2nd - Exchange is intermittently unreachable. I haven't checked the servers yet, but I'm thinking it's the cluster service failing and it has something to do with more damned patches.
  

The final tally for RNM: 22 days on the job. 244 patches applied to 18 servers. 3 hard drives crashed. 22GB of e-mail lost. I've personally spent at least 10 of those 22 days fixing broken stuff. The PC Tech hasn't had a chance to work on any user problems in two weeks. I can't even begin to calculate the productivity impact.

If you've read this far you may be wondering why there are so many outstanding patches. It's two things: First, the previous admins had an "if it's not broke don't fix it" mindset. Secondly, and more importantly, the previous network admins actually read what the patches were for and only applied the necessary ones. They also researched what the patch did and checked for reports of problems before he applied them. That's why things like .Net 3.0 wasn't applied to the DMZ server, because the prior admins knew it would cause problems with the ASP.Net 1.1 websites. They should probably have documented this somewhere, or at least flagged the patches so they didn't show up. I'll admit we were seriously behind on getting patches applied, but the shotgun approach of "apply everything and fix what breaks" is NOT acceptable to me.

You may also be wondering why RNM still has his job. I honestly don't know. If I were in charge he wouldn't be here. Since I'm not, I may not be here much longer myself. Someone who claims to have experience that would contraindicate doing stuff so stupid it brings down a production network shouldn't need a babysitter.