Risk
4/25/2012
12:37 PM
50%
50%

Mac Users Face Office Update Bugs, Flashback Variants

Microsoft removes an automated update for Office for Mac 2011 after users report corrupted Mac Outlook settings, and a new version of Flashback malware surfaces.

Anonymous: 10 Facts About The Hacktivist Group
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)
Microsoft has temporarily stopped issuing its most recent, automatic update for Office for Mac 2011, after some users reported that the update had corrupted or deleted their Outlook for Mac data. "Our goal is provide the simplest update experience for everyone--so we have temporarily stopped pushing out the SP2 update through Microsoft AutoUpdate while we investigate the issue," the company said in a blog post.

Microsoft had begun pushing the service pack 2 (SP2) update via its Apple OS X AutoUpdate software on April 12. But Friday, the company acknowledged that "a small percentage" of users were reporting that the update had created problems with their Outlook for Mac database, as well as this error message: "Please upgrade the Office database."

Although the automatic update has been suspended indefinitely, Office for Mac 2011 users still can download and install the SP2 update. But Microsoft has cautioned against doing so, at least without first using one of the two workarounds that the company has published to address the database issue, both of which involve rebuilding the Outlook database.

[ Better coding can protect against attacks, too. See Schwartz On Security: Secure Coding Or Bust. ]

Some users on Microsoft's Office for Mac site, however, are reporting that even with the workarounds, they're still not able to use Outlook. "This update is TERRIBLE. I did the update and now my text-only emails take 1-2 minutes to send and my emails with attachments fail altogether," said a poster who listed his name as Andrew. "I've rebuilt the database following the instructions, and [get] the same result."

A post from "Steve" said that the update had led to poorly managed network connections. "It appears that this update has made worse a problem that has plagued others--namely, that Outlook maintains a constant connection to Exchange (2007) and chews up nearly all available network bandwidth. This is seen within corporate networks as well as [for] remote [users]. Basically, it renders Outlook nearly useless as one has to terminate Outlook in order to do any other work."

Other users of the SP2 update have reported lost contacts, no longer being able to use right-to-left languages such as Arabic and Hebrew, broken Gmail IMAP connections, and inappropriate levels of CPU usage by Outlook.

In other bug-related Mac news, security software vendor Intego Monday said that it's seen a new version of the Flashback malware appear. Dubbed Flashback.S, the malware continues to target the Java vulnerability that Apple patched earlier this month.

If Flashback.S encounters an Apple OS X machine with the vulnerability, the Java applet can install itself automatically, no administrator-level password required. At that point, the applet installs multiple malicious files, then erases itself to help avoid detection. As with the previous version of Flashback, however, the malware won't attempt to install any malicious files--and in fact will immediately delete itself--if it detects the presence of Xcode, Little Snitch, or Mac antivirus software from one of a number of vendors.

InformationWeek is conducting a survey to gauge the state of enterprise data centers in 2012. Upon completion of our survey, you will be eligible to enter a drawing to receive an 32-GB Apple iPod Touch. Take our State Of The Data Center Survey now. Survey ends April 27.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5027
Published: 2014-12-26
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-2062. Reason: This candidate is a reservation duplicate of CVE-2010-2062. Notes: All CVE users should reference CVE-2010-2062 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2010-1441
Published: 2014-12-26
Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder.

CVE-2010-1442
Published: 2014-12-26
VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.

CVE-2010-1443
Published: 2014-12-26
The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty location element in an XML Shareable Playlist Format...

CVE-2010-1444
Published: 2014-12-26
The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.