Adobe Coldfusion 8 and 9 Vulnerable to Hijacking

Adobe released a security bulletin regarding the Coldfusion web engine. Upgrade / patch your Coldfusion server if you like to stay in control of your webserver. The patch has been classified as important.

An important vulnerability has been identified in ColdFusion 8.0, 8.0.1, 9.0, 9.0.1 for Windows, Macintosh and UNIX. This directory traversal vulnerability could lead to information disclosure (CVE-2010-2861). Adobe has provided a solution to the reported vulnerability. It is recommended that users update their product installation using the instructions provided above.

The patch/update get be downloaded here.

Posted on August 19, 2010 and filed under Security, Software.

'Official' Nikon Hand Strap II Review

I was in the market for a hand-strap. Nikon offers a AH-4 hand-strap for their cameras, but that accessory is over $70 USD. Not something you buy without knowing if it 'suits' you. Sure, I could get the official AH-4, and find out after a couple of days that it's not my cup of tea. Chances are slim that the store will get it back with a full refund, since it's used.

So I started to look around for a cheaper option, and I found one (well, several) on eBay. This Nikon Hand-Strap II is supposed to be official in/from Korea, but even the Korean Nikon website only shows the original AH-4. So it's a (cheap) knock-off, but that didn't keep me from getting one.

Posted on August 16, 2010 and filed under Photography, Review.

Microsoft Cryptographic Store and Passwords

We've been experimenting with with the use of user certificates for VPN access to the lab. Issuing, and using them isn't the problem. The problem is that there's no way of enforcing a password on the use of the private key. You can use private key protection on the certificate template, but that still doesn't enforce a password requirement. The user still has the option to choosing for the notification instead of a password.

Certificate Template - Request Handling OptionsThere's an option to enforce a password, but that's system wide for the Microsoft Cryptographic Service Provider, and we don't want to enforce passwords for ALL certificates. We just want to enforce passwords for this specific template.

Posted on August 12, 2010 and filed under Annoying, Microsoft, Security.

Them Crooked Vultures @ HMH

On June 10th, the "Them Crooked Vultures [1]" played in the Heineken Music Hall (HMH) in Amsterdam. The band consists of;

  • Dave Grohl on drums and vocals
    Former Nirvana, and Foo Fighters
  • Joshua Homme, lead gitare and vocals
    Former Queens of the Stone Age
  • John Paul Jones, every other instrument......
    Former Led Zeppelin

Them Crooked Vultures @ HMHAwesome 2 hour concert for a already legendary band that released only 1 CD so far.

Posted on July 26, 2010 and filed under Personal, Photography.

iPhone 3GS, iOS4 and MMS not working

I ran into a problem with MMS after I upgraded to iOS4 on my iPhone 3GS. Somehow, it was impossible to send MMS messages on the KPN cellular network. Searching the Internet revealed that I wasn't the only one.

The general consensus to solve this issue was a restore of the iPhone and not to restore old settings, but start from scratch.

After doing this, MMS still couldn't be sent from the iPhone, so time to do some more research. It turned out that KPN must have change the MMS settings, since my old MMS settings weren't correct anymore. So try these settings BEFORE you restore your iPhone. It might save you a lot of work and time.

Note: the following settings are for the Dutch KPN Network, and probably won't work on other networks / carriers.

Old Settings

APN: portalmmm.nl
Username:
Password:
MMSC: http://mp.mobiel.kpn/mmsc
MMS Proxy: 10.10.100.50:5080
MMS Max Message Size: 300000

New Settings

APN: portalmmm.nl
Username: kpn
Password: kpn
MMSC: http://mp.mobiel.kpn/mmsc
MMS Proxy: 10.10.100.20:5080
MMS Max Message Size: <leave empty>

Notice the differences? Anyway, with these new settings, MMS worked again.

KPN does have a page dedicated to the iPhone (in Dutch), regarding the Internet, and MMS settings. Just check those pages for the lastest settings.

I've updated the original page on my blog with the new settings.

Posted on July 23, 2010 and filed under Apple, Internet, Tips'n Tricks, iPhone.

OS X Kerberos / Open Directory Logging

Ever since I switched to OS X server at home I use Splunk> to see what's happening 'underneath the hood'. This revealed that there's a lot (really a whole lot) of Kerberos logging going on. Each and every day I get thousands of log entries regarding krb5kdc which results in over 1 million log entries only for krb5kdc in little over a week.

These syslog messages only contain the following 'text';

krb5kdc[16179](debug): routing msg not interesting
krb5kdc[16179](info): got routing msg type 5(RTM_LOSING) v5
krb5kdc[16179](info): routing socket readable

Looks like that the debugging level is set to debug (why??). And why can't we change it? Others seem to have this problem as well.

Looks like that the following command seems to work:

sudo defaults write /Library/Preferences/DirectoryService/DirectoryServiceDebug "Debug Logging Priority Level" FALSE

After entering that 1 line I haven't seen any new logentries in the kdc logs. More info on that command can be found @ Apple.

Nevermind......

Posted on July 22, 2010 and filed under Annoying, Apple, Operating Systems.

Vanishing HD Space on Popcorn Hour

Sometimes you think you're mind is playing tricks on you. I have that sometimes. E.g. I have a Popcorn Hour  (Networked Media Tank) which holds movies and series I watch. Bits and Bytes come and go on that machine. Thing you've seen are deleted, and replaced by new content. But over the 'years' it seemed to hold less and less content. Oke, movies have increased in size (10-20GB per movie is nothing nowadays). So I didn't really think much of it....

Until I started transporting the content with Transmit instead of FileZilla. Transmit was configured to show even the hidden files, and hidden files it showed. I found 4 hidden temporary pureftp-upload files of almost 32GB each. The timestamps on those files differed from late last year to a couple of months back

.pureftpd-upload-<some random string>

The problem was that I couldn't remove them from the Popcorn, but I really wanted my 120GD of free space back. Turned out that the FTP daemon on the Popcorn was locking these files. Reboot of the popcorn didn't help.

The way to remove them was to stop the FTP daemon on the Popcorn in the menu, and access the device through SMB (or another protocol you can use), and make sure that you can see hidden files.
Select the files and press delete, and they should be gone. After that you can re-enable the FTP service if you like.

Posted on July 15, 2010 and filed under Linux, Software, Tips'n Tricks, Video.

Getting Around a Wide-Angle Lens

Going on holiday is fun, but it's also a time of concessions on several levels. Especially if you can't bring every lens you own or (in theory) might need. Since the awesome Nikon 5-500mm f/1.8G VR ED N (small, <€1000, <1kg) isn't widely available. This means deciding what to bring in your camera bag.

In my case, I wanted to experiment with primes during my holiday. this also means that you have to use the foot-zoom, and on several occasions that won't work because of certain limitation (walls, buildings, ravines, etc.). In those cases you have 3 options;

  1. Don't make the photo
  2. Make a photo, but know immediately that it will end in /dev/null when you get home (a just-for-the-record photo).
  3. Improvise

So as you might have guessed, I ran into such a situation in Toledo, Spain. They have this great cathedral in the middle of an old town with narrow streets. You need a ultra-wide angle lens for almost anything there.

Posted on July 13, 2010 and filed under Photography, Software, Tips'n Tricks.

Splunk> Making Sense of Logfiles

My area of expertise in the professional world is Network Security. This includes protecting network from intrusions, but also delivering reports about the network status. For the latter we use SIEM(like) environments like the Cisco CS-MARS and the Juniper STRM.
The 'problem' with these devices is that they are great in reporting incidents and creating awesome reports about everything, but they lack the functionality to do some serious investigating.

I have several customers with a SIEM, and most of them still use (Linux) commandline tools like awk, grep, etc. these tools work, but you need to scrape everything together yourself, and building queries can be quite challenging. This is where Splunk> comes in.

Posted on July 13, 2010 and filed under Security, Software, Tips'n Tricks.

Slow Open Directory on OS X Server

Ever since I've been playing with my Mac mini with OS X server 10.6.4 I have had on-and-off problems in the authentication/Open Directory area.

  • Some accounts authenticate really quick, while others take minutes to authenticate.
  • Accessing the Open Directory through the Workgroup Manager is as slow as a slow boat to China. Changing users (just by selecting them) takes another boat along the Pacific.

So it was time to start digging into the phenomenon called 'Open Directory'.

The manual from Apple isn't much help in troubleshooting a slow Open Directory, so it was time to search the interwebs and start experimenting. If it didn't work, I can always reinstall the entire server from scratch.

Posted on July 12, 2010 and filed under Annoying, Apple, Tips'n Tricks.