Symantec Management Platform Agent and Package Server Vulnerability

The Symantec Management Platform Symantec Management Agent and/or Package Server Agent Disk Space Check and Drive Overflow features can potentially cause the space of it's system drive to be fully consumed. When this occurs, no additional data can be written to the drive, such as security patches or antivirus definitions.

As an example, a system where the Package Server Agent is installed on drive D. The Package Server was assigned more packages than the D drive had space for. The only drive with enough space for the download was the system drive, drive C. This drive was promptly consumed of drive space. After this it was noticed that antivirus definitions for Thursday, November 21, 2013 are for Wednesday, November 20, 2013 r25, but a system having this issue is nearly a month old.

Drive Space Check will check whether there is free space available on the drive containing the Package Server Agent installation. The amount of free space on a drive must be, at least, the value of the Min Disk Free Space (Mbytes) registry key in addition to 120% of the download size. If there is enough drive space, it will download it to this drive. If there is not enough drive space, the Drive Overflow feature is implemented.

Drive Overflow will check whether a drive, other than the drive containing the Package Server Agent installation, has available disk space for the download. If space is available on the drive, a folder will be created using the Package Server Agent installation path, replacing the drive letter with the drive letter of the using a path as the  has the space and download there, if no other drive has this space then it will not download the package.

Symantec HowTo Article 77389: FAQ on Package Servers

Silent Upgrade with In-Use Files Leaves Java Uninstalled (In-Progress)

This has been submitted to Oracle and entered as a bug into their bug tracking system under Bug Id: 9009448. This bug is not publicly available.

This issue is active. This page may be updated with additional information as it becomes available.

This issue was experienced when:

• Java 7 Update 11 to Java 7 Update 25 Upgrade on Windows x64
• Java 7 Update 25 to Java 7 Update 45 Upgrade on Windows x64
• Java 7 Update 45 to Java 7 Update 51 Upgrade on Windows x64
  This document focuses on the Java 7 Update 25 to Java 7 Update 45 Upgrade on Windows x64.

Issue

When Java is upgraded using the silent switch (/s) with the installer executable and Java files are in-use, the following is experienced:

• Java web sites and applets no longer work
• Java version verification site showed no version installed
• The previous version of Java was partially uninstalled from the file system
• The previous version of Java was removed from Programs and Features (aka Add/Remove Programs)
• The new version of Java was not installed on the file system
  * Java 7 Update 51: Files were installed in the Program Files folder, but missing from SysWOW64
• The new version of Java was added to Programs and Features (aka Add/Remove Programs)
• Java Control Panel applet is missing

What does this mean?

Most companies inventory a system using Programs and Features (aka Add/Remove Program) data. Moreover, most companies use patch software that detects installed versions that require patching. Both of these processes break when Java's installer causes this issue. The program shows as installed when the product is definitely not which will throw off installed totals, etc. Patching solutions will show the system as not requiring a patch or as even having the software.

Cause

The versions of Java were not packaged correctly to work when installations are performed silently. They neither take advantage of Windows Installer functionality nor address errors encountered. When an in-use file is encountered, the installation silently continues instead of rolling back.

This is different from installations that are not silent; during those installations the user is prompted to close the programs identified as having files in-use.

Additional Information

The executable is a wrapper that extracts a Windows Installer package. The Windows Installer package does not install the software, but instead places the installation files on the file system and runs Custom Actions to install Java.

When installing software on a given platform, a company must hire persons with the skill set to properly package software using technologies for that platform; in this case Windows Installer.

This issue is different, almost the exact opposite, of that described in JDK-7042296 : Silent Installations Break Java Installation, http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7042296, that was opened on 05/05/2011 and still has the status of Open and is Unresolved. This shows how much the vendor cares about their product and the persons/companies using it.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft is populated with Java 7 Update 45 data.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall is populated with Java 7 Update 45 data.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations is populated with Java 7 Update 45 data. This makes it impossible to install Java until the system is rebooted or the data for the value is modified to remove Java-specific entries.

Neither a repair nor an installation over the currently broken version can be performed. A full uninstall/install will be required.

Steps to Reproduce

Note: Java 7 Update 25 / Java 7 Update 45

1. Install Java 7 Update 25
   (jre-7u25-windows-i586.exe /s /norestart /L %windir%\system32\LogFiles\jre-7u25-windows-i586_inst.log)
2. Verify the installed Java web browser version
1. Open https://www.java.com/en/download/installed.jsp?detect=jre
2. Click Run when asked "Do you want to run this application?"
   Do not check the checkbox to "not show again"
3. Version shows as Java 7 Update 25
4. Close the web page.
3. Verify the installed Java system version
1. Open Java Control Panel (32-bit)
   ("%ProgramFiles% (x86)\Java\jre7\bin\javacpl.exe")
2. Select the Java tab
3. Select the User tab; version is 1.7.0_25
4. Select the System tab; version is 1.7.0_25
5. Close Java Conrol Panel (32-bit)
4. Verify the installed Java executables
1. Open a Command Prompt
2. Type: DIR %WINDIR%\SysWOW64\java*
3. Returns a list of Java executables
4. Close Command Prompt
5. Verify the installed Java in Programs and Features
1. Open/Refresh Programs and Features in Control Panel
2. Java 7 Update 25 is shown
3. Close Programs and Features
6. Verify the installed Java web browser version
1. Open https://www.java.com/en/download/installed.jsp?detect=jre
2. Do nothing when asked "Do you want to run this application?"
7. Install Java 7 Update 45
   (jre-7u45-windows-i586.exe /s /norestart /L %windir%\system32\LogFiles\jre-7u45-windows-i586_inst.log)
8. Review the installation log.
   (%windir%\system32\LogFiles\jre-7u45-windows-i586_inst.log)
1. The log showed 1603 errors
1. Must reboot to complete operation.
2. Close that application and retry.
2. The log showed the installation was successful.
1. Windows Installer installed the product. Product Name: Java 7 Update 45. Product Version: 7.0.450. Product Language: 1033. Manufacturer: Oracle. Installation success or error status: 0.
9. Close the web browser.
10. Verify the installed Java web browser version
1. Open https://www.java.com/en/download/installed.jsp?detect=jre
2. Click Run when asked "Do you want to run this application?"
   Do not check the checkbox to "not show again"
3. Version check errors
4. Close the web page.
11. Verify the installed Java system version
1. Open Java Control Panel (32-bit)
   ("%ProgramFiles% (x86)\Java\jre7\bin\javacpl.exe")
2. Select the Java tab
3. Select the User tab; version is 1.7.0_25
4. Select the System tab; version is 1.7.0_25
5. Close Java Conrol Panel (32-bit)
12. Verify the installed Java executables
1. Open a Command Prompt
2. Type: DIR %WINDIR%\SysWOW64\java*
3. Returns File not found
4. Close Command Prompt
13. Verify the installed Java in Programs and Features
1. Open/Refresh Programs and Features in Control Panel
2. Java 7 Update 45 is shown
3. Close Programs and Features

Disabling IPv6 causes 389/UDP to fail on domain controllers

Issue

When querying UDP port 389 locally on, or remotely to, a domain controller it fails with "LDAP query to port 389 failed Server did not respond to LDAP query"

Cause

One or more IPv6 components were disabled.

On the domain controller used in this example, the following command was used to disable IPv6:

The following commands will also cause this failure:


The following spreadsheet shows a breakdown of how the DisableComponents registry value affects 389/udp.

Resolution

Use any or all of the following commands to re-enable IPv6.

NOTE A reboot of the system is required when disabling or enabling IPv6 components.

Result

After re-enabling IPv6, querying 389/UDP completes successfully.

Conclusion

An environment that utilizes IPv4 and wishes to remove complexity by removing IPv6 may be surprised to find that its not so easily removed. Microsoft's Article, How to disable IP version 6 or its specific components in Windows, explains that the DisabledComponents registry key method is the correct way to disable IPv6. This article also states, "We do not recommend disabling IPv6. However, if you must disable IPv6 or components of IPv6, follow the steps in this article." Unfortunately, disabling IPv6 causes this known failure and may cause other unknown failures.

The Problem

iMessage is a feature for messaging between iOS devices. A problem arises when a user switches to another operating system, such as Google Android, but keeps the same phone number.

An Example

Kate and Henry both have iPhones and both of them use iMessage. Kate decides to trade-in her iPhone for a Samsung Galaxy. That night, Henry texts Kate some information. (Seems simple enough)

Neither Kate nor Henry are aware there is an issue. To Henry, the text went through because iMessage said it did. Kate never got the message because iMessage doesn't work with non-iOS devices.

How to disable iMessage for a device that is no longer needed

1. Go to https://supportprofile.apple.com
2. Sign in with the Apple ID the device was registered under.
   
   
3. Click on Edit Products
   
4. Click on the X to the right of the device.
   
   
5. Click Unregister
   
   

"This webpage has a redirect loop."

Using Google Chrome.

Gibson Research Corporation Cookie Forensics states to disable 3rd party cookies.

After disabling 3rd party cookies, entering credentials into accounts.google.com reloads the page allowing for the credentials to be entered again. Odd, but after this second time, the page loads correctly.

Attempts to correct #1

ACTION

In Settings, Show advanced settings..., Content Settings (under Privacy), Manage Exceptions (under Cookies); Add the following:

Hostname pattern: [*.]accounts.google.com
Behavior: Allow

RESULT

The address bar began a noticeable loop, finally ending with a message stating "This webpage has a redirect loop."
Attempts to correct #2

ACTION

In Settings, Show advanced settings..., Content Settings (under Privacy), Manage Exceptions (under Cookies); Modify the following:

Hostname pattern (Existing): [*.]accounts.google.com
Hostname pattern (Change to): [*.]google.com
Behavior: Allow

RESULT

The web page loaded successfully with only one login attempt.

CONCLUSION

When 3rd party cookies are disabled, websites may fail to load. In the case of Google, 3rd party cookies are used (and my guess, heavily) throughout their sites. Because of this, when 3rd party cookies are disable, their pages do not load. Initially, the issue appears to be with just the accounts.google.com site. When the accounts.google.com sites are allowed and the page starts looping, it happens so fast that the other google.com sites are unknown. Adding all google.com sites resolves the issue.

MORE INFORMATION

After making these changes, the page will load but additional blocking may show in the address bar. This could be due to Google's acquisition of YouTube. To correct for this, add the following:

Hostname pattern: [*.]youtube.com
Behavior: Allow

Logitech TV Cam HD (PN 960-000921)

After spending some time at Best Buy today, I thought I would create this page so that others would know the specifications for the Logitech TV Cam HD.

Skype Options

Calling

• Skype-to-Skype
• Phones and mobiles¹
• Conference Calls
• Voicemail (aka Voice Messaging)
• Caller ID
• Call Forwarding
• Call Transfer

Video

• Video calling
• Group video calling
• Screen Sharing

Messaging

• Instant Messaging
• Send Files
• Text Messaging
• Facebook News Feed
• SMS

Other

• Skype WiFi
• Online Number
• Skype To Go

Logitech Device Options

• Skype app built-in *
• Skype Certified
• HDMI connection to TV
• Widescreen HD 720p video **
• Wi-Fi (802.11 g/n) or Ethernet connection
• Built-in ringer (rings if TV is on or off)
• Carl Zeiss optics
• Logitech Fluid Crystal™ Technology
• Digital zoom, pan & tilt
• 4 noise cancelling microphones
• No computer required
• Width: 9-19/32"
• Depth: 2-51/64"
• Height: 2-5/64"

¹ Requires Skype Credit or a subscription.

* The version of Skype included does not support group calling.
** 1 1.2 Mbps upload/download for 720p video calling.

Windows 64-bit uses MSHTA.EXE 32-bit

By default, Windows 2008 R2 uses the 32-bit version of MSHTA.EXE even if the parent process is 64-bit, such as double-clicking an HTA from the Explorer process. This is due to the htafile association pointing to the 32-bit version.

While it seems that this should be corrected by updating the registry with the 64-bit path, there are sites on the Internet the state this might not be a good idea; though no reason was given. A quick guess is that the server-based HTA's used for server configuration may break.

An issue that was encountered due to this configuration is the calling of 32-bit programs when only the 64-bit version actually works.

For example, calling the NBTSTAT.EXE command from a 32-bit Command Prompt will result in the following error:

'nbtstat' is not recognized as an internal or external command, operable program or batch file.

The same error is encountered when using WScript.Shell.Exec to call NBTSTAT.EXE from a 32-bit MSHTA.EXE on a 64-bit operating system.

As a workaround, call the 64-bit/32-bit version directly by using a CMD or BAT file that uses a similar command (this command will call the 32-bit version on a 32-bit OS and the 64-bit version on a 64-bit OS):

START %windir%\system32\mshta.exe "<PathToHTA>"