Cisco fixes major security flaws in Webex on Windows and Mac

Cisco has addressed two high severity vulnerabilities in its Webex video conferencing software that could have allowed unprivileged attackers to run programs and code on vulnerable systems.

The two vulnerabilities, tracked as CVE-2020-3263 and CVE-2020-3342, affect Cisco Webex Meetings Desktop App releases earlier than version 39.5.12. and all Webex users should update their software to the latest version to avoid falling victim to any potential exploits.

In an advisory concerning the arbitrary program execution flaw affecting Webex's Windows client, Cisco provided more details on the vulnerability and explained what an attacker could do to a user's system following a successful exploit, saying:

“The vulnerability is due to improper validation of input that is supplied to application URLs. The attacker could exploit this vulnerability by persuading a user to follow a malicious URL. A successful exploit could allow the attacker to cause the application to execute other programs that are already present on the end-user system. If malicious files are planted on the system or on an accessible network file path, the attacker could execute arbitrary code on the affected system.”

Webex vulnerabilities

Cisco also patched a remote code execution vulnerability in Webex's Mac client that was caused by improper certificate validation on software update files downloaded by the software.

The vulnerability could allow an unauthenticated attacker to remotely execute arbitrary code with the same privileges of the logged in user on macOS. In a separate advisory, Cisco explained how an attacker could exploit the vulnerability, saying:

“An attacker could exploit this vulnerability by persuading a user to go to a website that returns files to the client that are similar to files that are returned from a valid Webex website. The client may fail to properly validate the cryptographic protections of the provided files before executing them as part of an update.”

Cisco has since fixed both of these vulnerabilities with the release of version 40.1.0 of Webex for Windows and version 39.5.11 of Webex for Mac. Windows and Mac users can update their Cisco Webex clients by following these instructions while admins can update both versions of the client by following this guide.

Via BleepingComputer

TechRadar – All the latest technology news

Read More

This 4TB PCIe SSD can make your Windows laptop feel more like a MacBook Pro

The Apple MacBook Pro 16 still holds bragging rights when it comes to the maximum storage capacity available in a traditional portable laptop. 

Apple uses a proprietary approach, plugging memory chips directly into the motherboard to reach a whopping 8TB of storage, while only a handful of vendors even offer 4TB PCIe SSDs.

OWC has recently joined Sabrent as only the second consumer vendor to offer a 4TB NVMe PCIe M2.2280 SSD. OWC's Aurora P12 costs $ 1,149.88, while Sabrent's offering, known as Rocket, is available for only $ 849.99 from Amazon (roughly £690/AU$ 1335).

Why does that matter? Well, because you can plug two into a Windows laptop to match the MacBook Pro's 8TB capacity.

There’s only one laptop vendor worldwide (Eurocom), to our knowledge, that bundles its laptops with these 4TB drives – and they’re neither as cheap nor as portable as Apple’s slim-and-thin mobile workstation.

Apple charges $ 6,099 for the very top of the range 16-inch MacBook Pro, while Dell has, unfortunately, stopped pushing 2TB PCI NVMe SSD with its 64GB XPS 15 laptop

As for the Sabrent Rocket, it is an x4 model that comes bundled with the Acronis True Image software, Toshiba’s BICS3 flash and Sabrent’s own RKT303 controller. Its performance speeds can reach up to 3450 MB/s (read) and 3000 MB/s (write).

Just bear in mind, this is a Gen 3 rather than a Gen 4 SSD.

TechRadar – All the latest technology news

Read More

Windows 10 updates could now slow down your PC – here’s how to fix them

Several recent Windows 10 updates are seriously impacting the speeds of PCs they are installed on.

According to Windows Latest, Windows 10 updates KB4535996, KB4540673 and KB4551762 could all make your PC slower to boot.

While KB4535996 is an optional update, and has been accused of introducing various problems into Windows 10 since its launch on February 27, Windows 10 KB4540673 and KB4551762 are standard updates, which means they are more likely to have been installed on your PC.

Not only are these updates making PCs slower to boot, when Windows 10 does load up, some people have noticed that their computers act more slowly than before – for example taking longer to load up apps or open folders.

Not everyone will be affected by these issues, but in its testing, Windows Latest found that Windows 10 KB4535996 was particularly bad at slowing down various PCs.

New Windows 10 KB4551762 issues

Windows Latest is also reporting on performance issues with the Windows 10 KB4551762 update. This update, which is for people running Windows 10 1903 and 1909 versions (the two latest major Windows 10 releases) is causing people to notice abnormal processor and disk usage – which can seriously impact the performance of the computer.

One of our biggest concerns is that Windows 10 KB4551762 is billed as an important update that is supposed to bring a number of fixes. That means Windows 10 users are being encouraged to install it.

People in Windows Latest’s comment section, as well as Microsoft’s support forums and on Reddit, have been complaining about issues their PCs are having after installing the update, including slow boot times, system crashes and the dreaded Blue Screen of Death.

Some people are also stating that the update itself fails to install, instead throwing up an error message. This might be a blessing in disguise.

How to fix these problems

For each of these faulty Windows 10 updates, the easiest way of fixing the problems they have brought is to uninstall the updates themselves. Once uninstalled, users have reported that the issues have cleared up.

Thankfully, the process of uninstalling a Windows 10 update is pretty simple. Open up the Settings app (the cog icon in the Start menu, or by pressing Windows + I on the keyboard), then click 'Update & security'.

From the window that appears, click 'Windows Update' on the left-hand menu, then 'View update history'. Click 'Uninstall updates' then select the name of the troublesome update to uninstall it. The problems should now be fixed.

TechRadar – All the latest technology news

Read More

Windows 7 should live on as open source, spectacularly optimistic petition demands

Windows 7 may have reached end-of-life, with official support no longer provided (at least not for free), but the veteran OS could live on if Microsoft released it as open source.

That’s the demand – and it is a demand, not a suggestion – from the Free Software Foundation (FSF), which has issued a petition calling for Microsoft to ‘upcycle’ Windows 7 by turning it open source.

After all, Microsoft is huge on everything open source these days, right? It’s all about open source, listening to user feedback, and acting on it.

The feedback from FSF might raise a few hackles at Microsoft, though, as the wording of the petition is, shall we say, on the strong and blunt side.

It reads: “On January 14th, Windows 7 reached its official ‘end-of-life,’ bringing an end to its updates as well as its ten years of poisoning education, invading privacy, and threatening user security. The end of Windows 7’s lifecycle gives Microsoft the perfect opportunity to undo past wrongs, and to upcycle it instead.

“We call on them to release it as free software, and give it to the community to study and improve. As there is already a precedent for releasing some core Windows utilities as free software, Microsoft has nothing to lose by liberating a version of their operating system that they themselves say has ‘reached its end.’”

And FSF further directly addresses Microsoft executives to “demand that Windows 7 be released as free software”, and urges them “to respect the freedom and privacy of your users – not simply strongarm them into the newest Windows version.”

Nothing to lose?

Of course, the truth is that making Windows 7 open source would be an unprecedented and radical move, and there are obvious problems with this idea.

FSF might insist that Microsoft has ‘nothing to lose’, but that’s not really the case, is it?

Microsoft could obviously potentially lose users who will soon – or eventually – upgrade to Windows 10 (if they don’t look entirely elsewhere for an OS).

And remember that Microsoft is still making money from Windows 7, by charging for extended support beyond end-of-life (business users can get an extra year of support with certain versions of Windows 7, and there’s a scheme that allows companies to pay for additional support on top of that). 

Moreover, there would be obvious dangers for Windows 10 in such an endeavor, because a good deal of Windows 7 code was carried on into Microsoft’s most recent OS, of course.

In short, there’s vanishingly-little-to-no-chance of this actually happening, in spite of how many signatures the petition might end up gathering – with the tally currently standing at just over 1,000. FSF wants to get 7,777 supporters on board, and that might just happen as word of the petition spreads.

But no matter how much Microsoft might be pushing the angle that it wants to work with open source projects across all fronts, in all kinds of different ways, Windows 7 being opened up to all and sundry just isn’t going to happen.

Via The Register

TechRadar – All the latest technology news

Read More

Windows 10’s latest troublesome update is now reportedly causing boot failures

Microsoft has run into more trouble with Windows 10 updates, as a recent important security patch which had previously been problematic by failing to install for some folks, is now causing serious crashes – and even boot failures – in some reported cases.

Windows Latest spotted the fresh problems with update KB4528760 for Windows 10 May 2019 Update and the November 2019 Update, which has been failing to install for a number of users, providing only unhelpful error messages.

Worse still, it would now appear that these issues are not only widespread – with in excess of 100 complaints on Microsoft’s help forum – but for some folks, KB4528760 is causing grief like the dreaded blue screen of death and boot failure.

One user on the Windows 10 Feedback Hub observed: “The recent KB4528760 update for Windows 1909 [November 2019 Update] seems to be causing issues with some computers and stopping them from booting. Presenting the error code 0xc000000e. Increasing number of machines hitting this issue after installing this update.”

Connect flaw?

As to what might be going on with the KB4528760 update, one theory floated by a volunteer moderator on Microsoft’s Answer.com help forum is that the majority of the users who are encountering update failures (or worse) – even when attempting a manual install as a workaround – have “manually removed the Connect app from Windows”.

Connect is a default Windows 10 app which facilitates wireless display connections (allowing you to, for example, mirror your phone screen to the PC), but it’s not clear if this is what’s truly at fault – although this application has been blamed in previous Windows 10 update failures.

Indeed, another theory we’ve seen floated on Reddit is that those folks running AMD Ryzen processors might be more likely to be affected (in terms of this update failing, and previous patches for that matter). But take that with a hefty pinch of salt.

Whatever the case, it’s clear that Microsoft keeps messing up with these cumulative updates, and has been doing so since that infamous long run of patches last year which kept causing new problems while fixing the old ones.

In order to avoid a situation where Windows 10 users are going to start dreading installing cumulative updates for fear of what might go wrong, Microsoft needs to pull its patching socks up and do better than this.

The situation is worse than normal in this particular case, seeing as KB4528760 is an important fix for a glaring security hole.

TechRadar – All the latest technology news

Read More