Risk
4/25/2012
12:37 PM
Connect Directly
RSS
E-Mail
50%
50%

Mac Users Face Office Update Bugs, Flashback Variants

Microsoft removes an automated update for Office for Mac 2011 after users report corrupted Mac Outlook settings, and a new version of Flashback malware surfaces.

Anonymous: 10 Facts About The Hacktivist Group
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)
Microsoft has temporarily stopped issuing its most recent, automatic update for Office for Mac 2011, after some users reported that the update had corrupted or deleted their Outlook for Mac data. "Our goal is provide the simplest update experience for everyone--so we have temporarily stopped pushing out the SP2 update through Microsoft AutoUpdate while we investigate the issue," the company said in a blog post.

Microsoft had begun pushing the service pack 2 (SP2) update via its Apple OS X AutoUpdate software on April 12. But Friday, the company acknowledged that "a small percentage" of users were reporting that the update had created problems with their Outlook for Mac database, as well as this error message: "Please upgrade the Office database."

Although the automatic update has been suspended indefinitely, Office for Mac 2011 users still can download and install the SP2 update. But Microsoft has cautioned against doing so, at least without first using one of the two workarounds that the company has published to address the database issue, both of which involve rebuilding the Outlook database.

[ Better coding can protect against attacks, too. See Schwartz On Security: Secure Coding Or Bust. ]

Some users on Microsoft's Office for Mac site, however, are reporting that even with the workarounds, they're still not able to use Outlook. "This update is TERRIBLE. I did the update and now my text-only emails take 1-2 minutes to send and my emails with attachments fail altogether," said a poster who listed his name as Andrew. "I've rebuilt the database following the instructions, and [get] the same result."

A post from "Steve" said that the update had led to poorly managed network connections. "It appears that this update has made worse a problem that has plagued others--namely, that Outlook maintains a constant connection to Exchange (2007) and chews up nearly all available network bandwidth. This is seen within corporate networks as well as [for] remote [users]. Basically, it renders Outlook nearly useless as one has to terminate Outlook in order to do any other work."

Other users of the SP2 update have reported lost contacts, no longer being able to use right-to-left languages such as Arabic and Hebrew, broken Gmail IMAP connections, and inappropriate levels of CPU usage by Outlook.

In other bug-related Mac news, security software vendor Intego Monday said that it's seen a new version of the Flashback malware appear. Dubbed Flashback.S, the malware continues to target the Java vulnerability that Apple patched earlier this month.

If Flashback.S encounters an Apple OS X machine with the vulnerability, the Java applet can install itself automatically, no administrator-level password required. At that point, the applet installs multiple malicious files, then erases itself to help avoid detection. As with the previous version of Flashback, however, the malware won't attempt to install any malicious files--and in fact will immediately delete itself--if it detects the presence of Xcode, Little Snitch, or Mac antivirus software from one of a number of vendors.

InformationWeek is conducting a survey to gauge the state of enterprise data centers in 2012. Upon completion of our survey, you will be eligible to enter a drawing to receive an 32-GB Apple iPod Touch. Take our State Of The Data Center Survey now. Survey ends April 27.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4734
Published: 2014-07-21
Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

CVE-2014-4960
Published: 2014-07-21
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.

CVE-2014-5016
Published: 2014-07-21
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to appl...

CVE-2014-5017
Published: 2014-07-21
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter...

CVE-2014-5018
Published: 2014-07-21
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.