Friday, December 30, 2011

What is the purpose of this alert



 what this alert is to provide you with an overview of the new security bulletin being released (out-of-band) on December 29, 2011.
 
  NEW SECURITY BULLETIN  



 
Microsoft is releasing one new security bulletin (out-of-band) for newly discovered vulnerabilities:
Bulletin ID Bulletin Title Maximum Severity Rating Vulnerability Impact Restart Requirement Affected Software*
MS11-100 Bulletin Title Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420) Critical Elevation of Privilege This update may require a restart All supported versions of ASP.NET on all supported versions of Windows and Windows Server.*
* Where indicated in the Affected Software table on the bulletin webpage, the vulnerabilities addressed by this update may affect supported editions of Windows Server 2008 or Windows Server 2008 R2, when installed using the Server Core installation option. Affected software listed above is an abstract. Please see the security bulletin at the link provided for complete details.
 
     
 
PUBLIC BULLETIN WEBCAST

 
Microsoft will host a webcast to address customer questions on these bulletins:

Title: Information About Microsoft's December 2011 Out-of-Band Security Bulletin Release
Date: Thursday, December 29, 2011, at 1:00 P.M. (GMT-08:00) Pacific Time (U.S. & Canada)
URL: https://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032502798
 
PUBLIC RESOURCES RELATED TO THIS ALERT

 
Security Bulletin MS11-100 - Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420): http://technet.microsoft.com/security/bulletin/MS11-100
Security Advisory 2659883 - Vulnerability in ASP.NET Could Allow Denial of Service http://technet.microsoft.com/security/advisory/2659883
Microsoft Security Response Center (MSRC) Blog: http://blogs.technet.com/msrc/
Microsoft Security Research & Defense (SRD) Blog: http://blogs.technet.com/srd/

NEW SECURITY BULLETIN TECHNICAL DETAILS

 
In the following tables of affected and non-affected software, software editions that are not listed are past their support lifecycle. To determine the support lifecycle for your product and edition, visit the Microsoft Support Lifecycle website at http://support.microsoft.com/lifecycle/.
Bulletin Identifier Microsoft Security Bulletin MS11-100
Bulletin Title Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)
Executive Summary This security update resolves one publicly disclosed vulnerability and three privately reported vulnerabilities in Microsoft .NET Framework. The most severe of these vulnerabilities could allow elevation of privilege if an unauthenticated attacker sends a specially crafted web request to the target site. An attacker who successfully exploited this vulnerability could take any action in the context of an existing account on the ASP.NET site, including executing arbitrary commands.

The security update addresses the vulnerabilities by correcting the manner in which the .NET Framework handles specially crafted requests, and the manner in which the ASP.NET Framework authenticates users and handles cached content.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 2659883.
Affected Software This security update is rated Critical for Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5 Service Pack 1, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Microsoft Windows.
CVE, Exploitability Index Rating
CVE-2011-3414: Collisions in Hash Table May Cause DoS Vulnerability (EI = 3)
CVE-2011-3415: Insecure Redirect in .NET Forms Authentication Vulnerability
(EI = NA)
CVE-2011-3416: ASP.NET Forms Authentication Bypass Vulnerability (EI = 1)
CVE-2011-3417: ASP.NET Forms Authentication Ticket Caching Vulnerability (EI = 2)
Attack Vectors
An unauthenticated attacker could send a small number of specially crafted ASP.NET requests to an affected ASP.NET site, causing a denial of service condition. (CVE-2011-3414)
An attacker could create a specially crafted URL and convince a user to click it. After the user logs on to an expected website, the attacker then redirects the user to a website controlled by the attacker. Once there, the attacker could convince the user to divulge information otherwise intended to remain private. (CVE-2011-3415)
An unauthenticated attacker would need to obtain a valid account name to the site. The attacker could then craft a special web request using a previously registered account name to gain access to that account. (CVE-2011-3416)
An attacker could exploit the vulnerability by sending a specially crafted link to the user and convincing the user to click the link. (CVE-2011-3417)
Mitigating Factors
CVE-2011-3414 (Collisions in Hash Tables May Cause DoS Vulnerability)
By default, IIS is not enabled on any Windows operating system.
Sites that disallow "application/x-www-form-urlencoded" or "multipart/form-data" HTTP content types are not vulnerable.
CVE-2011-3415 (for Insecure Redirect in .NET Form Authentication Vulnerability)
This vulnerability would not allow an attacker to execute code or to elevate their user rights directly, but it could be used to produce information that could be used to try to further compromise user information.
By default, installing ASP.NET does not enable Forms Authentication. It has to be explicitly configured per-application to be enabled.
IIS is not installed by default.
By default, ASP.NET is not installed when .NET Framework is installed. Only customers who manually install and enable ASP.NET are likely to be vulnerable to this issue.
The attacker would have to convince the user to click a link in order to exploit the vulnerability.
CVE-2011-3416 (Forms Authentication Bypass Vulnerability)
An attacker must be able to register an account on the ASP.NET application, and must know an existing user name.
By default, installing ASP.NET does not enable Forms Authentication. It has to be explicitly configured per-application to be enabled.
IIS is not installed by default.
By default, ASP.NET is not installed when .NET is installed. Only customers who manually install and enable ASP.NET are likely to be vulnerable to this issue.
CVE-2011-3417 (Forms Authentication Ticket Caching Vulnerability)
By default, ASP.NET responses are not cached by the OutputCache. The developer of the site has to opt-in to output caching via the OutputCache directive on a page.
An attacker who successfully exploited this vulnerability could gain the same user rights as the target user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
By default, IIS is not installed on any affected operating system version. Only customers who manually install this are likely to be vulnerable to this issue.
By default, ASP.NET is not installed when .NET is installed. Only customers who manually install and enable ASP.NET are likely to be vulnerable to this issue.
Restart Requirement This update may require a restart.
Bulletins Replaced by This Update MS10-070 and MS11-078.
Publicly Disclosed?

Exploited?
CVE-2011-3414 (Collisions in Hash Tables May Cause Denial of Service Vulnerability) was publicly disclosed prior to release. The other three vulnerabilities were private.

At this time we are not aware of any exploits in the wild for any of these vulnerabilities.
Full Details http://technet.microsoft.com/security/bulletin/MS11-100
 
REGARDING INFORMATION CONSISTENCY

 
We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Microsoft's security content posted to the web is occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in Microsoft's web-based security content, the information in Microsoft's web-based security content is authoritative.

If you have any questions regarding this alert please contact your Technical Account Manager.

Thank you,
Gurbinder Sharma
Microsoft CSS Security Team

Thursday, December 29, 2011

Difference between Seek Time and Latency

Seek Time
The seek time of a hard disk measures the amount of time required for the read/write heads to move between tracks over the surfaces of the platters. Seek time is one of the most commonly discussed metrics for hard disks, and it is one of the most important positioning performance specifications. However, using this number to compare drives can be somewhat fraught with danger. Alright, that's a bit melodramatic; nobody's going to get hurt or anything. :^) Still, to use seek time properly, we must figure out exactly what it means.
Switching between tracks requires the head actuator to move the head arms physically, which being a mechanical process, takes a specific amount of time. The amount of time required to switch between two tracks depends on the distance between the tracks. However, there is a certain amount of "overhead" involved in track switching, so the relationship is not linear. It does not take double the time to switch from track 1 to track 3 that it does to switch from track 1 to track 2, much as a trip to the drug store 2 miles away does not take double the time of a trip to the grocery store 1 mile away, when you include the overhead of getting into the car, starting it, etc.
Seek time is normally expressed in milliseconds (commonly abbreviated "msec" or "ms"), with average seek times for most modern drives today in a rather tight range of 8 to 10 ms. Of course, in the modern PC, a millisecond is an enormous amount of time: your system memory has speed measured in nanoseconds, for example (one million times smaller). A 1 GHz processor can (theoretically) execute over one million instructions in a millisecond! Obviously, even small reductions in seek times can result in improvements in overall system performance, because the rest of the system is often sitting and waiting for the hard disk during this time. It is for this reason that seek time is usually considered one of the most important hard disk performance specifications. Some consider it the most important.

Latency
The hard disk platters are spinning around at high speed, and the spin speed is not synchronized to the process that moves the read/write heads to the correct cylinder on a random access on the hard disk. Therefore, at the time that the heads arrive at the correct cylinder, the actual sector that is needed may be anywhere. After the actuator assembly has completed its seek to the correct track, the drive must wait for the correct sector to come around to where the read/write heads are located. This time is called latency. Latency is directly related to the spindle speed of the drive and such is influenced solely by the drive's spindle characteristics. This operation page discussing spindle speeds also contains information relevant to latency.
Conceptually, latency is rather simple to understand; it is also easy to calculate. The faster the disk is spinning, the quicker the correct sector will rotate under the heads, and the lower latency will be. Sometimes the sector will be at just the right spot when the seek is completed, and the latency for that access will be close to zero. Sometimes the needed sector will have just passed the head and in this "worst case", a full rotation will be needed before the sector can be read. On average, latency will be half the time it takes for a full rotation of the disk.

Saturday, December 10, 2011

Dear Friends
This is what happening in the punjab , I am feeling ashamed after seeing the video on facebook  which shows ,how shamelessly a Akali Dal Badal Member & Sarpanch of the Village Slaps a ETT Teacher while she was waiting for the Harsimrat Kaur to tell her their pains & agonies.Watch what the police was doing at the moment.
Pls dare to step up against these kind of bastards.

Best Regards
Gurbinder Sahrma

Thursday, November 24, 2011

A VERY SHAMEFUL FACT ABOUT CHINA

It's the shameful secret that those in the international fur trade do their best to hide.

Cats and dogs in China – more than 2 million individual animals this year alone – will be killed for their fur. Animals like the ones we share our homes with as beloved family members are being routinely abused and slaughtered for their fur.
This cold fact has been witnessed repeatedly by investigators from PETA Asia and independent animal protection organisations around the world.

PETA is leading the campaign against the bloody fur industry. Please support our efforts for all animals today with a special gift to bolster our life-saving work.
The animals suffering in these markets can't tell their own story, so I'll relay to you just some of what PETA Asia investigators have documented:
"Workers stuffed hundreds of terrified animals into cages to make the trip to the Chinese animal markets. No food or water was provided." "The cages were packed so full that the animals couldn't move inside. And dying or dead animals were packed in with the living." "When they arrived at the market, the cages were tossed 10 feet from the tops of the trucks to ground below, shattering the bones of the fearful animals inside." "At the market, the killing methods used shocked even our most seasoned investigators – bludgeoning and even skinning the animals while they were still alive!"

All these horrors take place so that someone can have a fur coat or fur trim on a hat. It's outrageous and must be stopped.

The skins of these animals find their way to the international clothing retail markets and are sometimes misleadingly labelled as anything from "Asian jackal" to "rabbit".


I know that it's hard to read about this cruelty. But I want you to know how you can be a part of ending this misery – by supporting PETA's work to save these and other animals from being abused in the name of a violent, greedy industry built on suffering. Please send a special gift to help fund PETA's ongoing campaigns to stop the suffering of animals in China and around the world.
We're leading eye-opening campaigns against retailers and designers who still use fur, and we've convinced others to eliminate or pledge never to use fur and exotic skins in their collections. We hold protests and educate the media and the public about the ugly truth behind the fur industry.

Of course, ending this cruel killing of animals will require a sustained and monumental effort. But we're up to the task and hope that you will stand with us.

With your special gift today, you'll help PETA continue to fight against the suffering and abuse of animals wherever and whenever it occurs.

Thank you for everything that you do for animals.
Kind regards,
Gurbinder Sharma
Volunteer PETA INDIA
09876023524





.

Tuesday, November 22, 2011

HANDS ON SCRIPT

Know your back panel


You’ve probably faced problems when shifting your comp or getting a new peripheral as to which cable goes where and what the empty ports might be for. If you look closer you’ll realise that it’s not as complicated as it seems. The back panel has been built in such a way that each port/ socket is built to accommodate only one connection/ wire … the one that it’s meant to!



A word of advice: Remember not to force any connectors into any of the given ports – they are designed to only go in one way. And if they do not fit easily, you are surely putting the wrong connector in the given slot or vice versa.



So what goes where?



The PS/2 ports for keyboard and mouse

If you look towards the top of the back panel, there are normally two PS/2 ports—one for the keyboard and one for the mouse. The two ports are colour coded, so you cannot mistake one for the other (blue for keyboard and green for the mouse). As a rule of thumb, the PS/2 keyboard port is the lower port while the PS/2 mouse port is above it.



Attaching the non-PS/2 Keyboard

If you don’t have a PS/2 mouse or keyboard, you won’t have any problem recognising the non-PS/2 port for the keyboard. The keyboard fits in properly into the round port provided for it. This port is located near the top of the back panel right below the power connector.



Attaching the mouse

The non-PS/2 mouse fits into what is known as the COM port. You can recognize the COM port by the fact that it has pins in it, so your mouse fits into it properly. You will normally have a 9-pin COM port and a 25-pin COM port. The mouse fits into the 9-pin port. Normally, the port will have an indicator, which will tell you which side to keep up when putting in the mouse cable. In case it doesn’t have an indicator, just check the port so that the five pins above and four pins below (or vice versa) match the holes in the mouse and attach the mouse accordingly.



Attaching the modem

The other COM port with the 25 pins is usually for an external modem. You attach the modem in a similar manner as you would the mouse. You just have to ensure that the 16 pins above and 9 pins below (or vice versa) match the holes in the modem.



Attaching the printer to the parallel port

The printer port or the parallel port as it’s usually called, is the one with 25 holes. You use it for connecting the printer cable (or Zip drive or scanner cable).



Connecting speakers, microphone and joystick

The ports at the bottom are for attaching the speaker connectors and microphone. These wire to the soundcard.

Normally, the soundcard has three small round ports (apart from a game port) to perform specific sound functions. The ports are usually marked as Line Out – To grab sound from the sound card, Line In – For external sound capture from an outside source, and Speakers Out - To connect speakers to the sound card for audio output

Most soundcards these days also have colour-coded ports so you cannot mistake them. Besides, the function of the port is written right next to it.



The game port, which is usually part of the soundcard, could be used to connect gaming peripherals like a ‘Joystick’.



Connecting monitor cable to display adaptor

The isolated port that looks like a narrower version of the parallel port and has three rows of pins, is where you connect the monitor’s cable. An indicator on the monitor cable should say which side is up, so you shouldn’t have any problems with this one either as the plug will only go in one way. This port is situated on the VGA card of the computer.



Like we said earlier, if you look closer, you’ll realise that your computer is more user friendly than you think. The apparent maze of wires on the back panel leads to a simple solution at the end of the hunt



THIN CLIENTS AN OVERVIEW

THIS IS ABOUT THIN CLIENTS :


PERFORMANCE


INSTALLATION


CONFIGURATION


WORTHINESS




Thin Clients are just like normal pc’s but the big difference is the Size & Cost. Thin Clients are cheaper than desktop pc .They are smaller in size than a normal system unit .They are square like boxes mount behind the LCD.

FEATURES: Compact size,No CPU,No Memory,No cooling needs(no Fan inside).

Contains a ethernet connector, keyboard port, mouse port, audio port & USB ports(Optional not in every version),Display adapter and power input with on of off switch.

Seems cool and sound good that buy one high end pc (intel core 2 duo @ 3.4 ghz or higher, ddr ram upto 4gb,high speed ethernet card etc.)

Supported Operating Systems are Win-xp SP3 , win server-2003 , win server small buisness and linux.Installation is preity easy with the cd .

Win-xp SP3 Supports 10 Users accoording to the company specifications and all users must be members of remote desktop users .connectivity is through terminal server services.hence multi user support is necessary. Win Server-2003 supports upto 30 users but main difference is the security/roles /policies to restrict users from unauthenticated services.

PERFORMANCE: I am using enjay thin clients UTS(Ultra Thin Series)without any USB ports.I am not criticized the product but sorry to say , these are not upto the mark every day a new issue arises like connectivity/display/hang up and console is not accept the modifications done by Admin and you are unable to access the Client directly to change any settings.

Update and tech support is very poor devices are made in china so web site is also hosted by chinese kimsen.com .you required to install native support for chinese simplified otherwise you are unable to register online and update your console software. It is not updated since 2008.

Configuration: is easy run console cd and installed the client software it asks you at the end that if you want to Add new users click yes and simply create the users by following on screen instructions.

Uses static ip addresses so no need of dhcp .devices missing the redundency so check your power supplies and back up a little fluctuation can damage the client.

WORTHINESS: AVG. according to me its better to use separate units that run on their own resources and give you less trouble. Cost cutting is not always paying.





Tuesday, January 18, 2011

Are you Aware of Your UPS & PC Compatibility?

Most unknown people bought a UPS as suggest by some one or dealer/retailer.However its a matter of concern for your pocket becoz if your UPS is not completing your PC's Requirement . You are in Trouble.

I will Tell You Briefly , How to measure the capacity of UPS & PC .

this tech note helps explain the differences between Watts and VA and explains how the terms are correctly and incorrectly used in specifying power protection equipment. Many people are confused about the distinction between the Watt and Volt-Amp (VA) measures for UPS load sizing. Many manufacturers of UPS and load equipment add to this confusion by failing to distinguish between these measures. If you have arrived at this site in an attempt to be a more informed buyer of UPS or other power equipment, congratulations. Please feel free to email me at gurbinder.sharma@gmail.com so that I may assist you in selecting the correct equipment. Power Solutions is an independent supplier of power quality products offering the best in class solutions.

Background : The power drawn by computing equipment is expressed in Watts or Volt-Amps (VA). The power in Watts is the real power drawn by the equipment. Volt-Amps are called the "apparent power" and are the product of the voltage applied to the equipment times the current drawn by the equipment. Both Watt and VA ratings have a use and purpose. The Watt rating determines the actual power purchased from the utility company and the heat loading generated by the equipment. The VA rating is used for sizing wiring and circuit breakers. The VA and Watt ratings for some types of electrical loads, like incandescent light bulbs, are identical. However, for computer equipment the Watt and VA ratings can differ significantly, with the VA rating always being equal to or larger than the Watt rating. The ratio of the Watt to VA rating is called the "Power Factor" and is expressed either as a number (i.e. 0.7) or a percentage (i.e. 70%). We can assist you with proper UPS sizing if you provide us with either, total equipment VA, total equipment Watts, or a list of the equipment part numbers that you would like to back up. The Watt rating for a computer may not be equal to the VA rating . All Information Technology equipment including computers uses an electronic switching power supply. There are two basic types of computer switching power supplies, which are called 1) Power Factor Corrected supplies or 2) Capacitor Input supplies. It is not possible to tell which kind of power supply is used by inspection of the equipment, and this information is not commonly provided in equipment specifications. Power Factor Corrected or PFC supplies were introduced in the mid 1990's and have the characteristic that the Watt and VA ratings are equal (power factor of 0.99 to 1.0). Capacitor Input supplies have the characteristic that the Watt rating is in the range of .55 to .75 times the VA rating (power factor of 0.55 to 0.75).

All large computing equipment such as routers, switches, drive arrays, and servers made after about 1996 uses the Power Factor Corrected supply and consequently for this type of equipment the power factor is 1. Personal computers, small hubs, and personal computer accessories typically have Capacitor Input supplies and consequently for this type of equipment the power factor is less than one, and is ordinarily in the range of 0.65. Larger computer equipment made prior to 1996 also typically used this type of power supply and exhibited a power factor less than one.



The power rating of the UPS

UPS have both maximum Watt ratings and maximum VA ratings. Neither the Watt nor the VA rating of a UPS may be exceeded. It is a de-facto standard in the industry that the Watt rating is approximately 60% of the VA rating for small UPS systems, this being the typical power factor of common personal computer loads. In some cases, UPS manufacturers only publish the VA rating of the UPS. For small UPS designed for computer loads, which have only a VA rating, it is appropriate to assume that the Watt rating of the UPS is 60% of the published VA rating. For larger UPS systems, it is becoming common to focus on the Watt rating of the UPS, and to have equal Watt and VA ratings for the UPS, because the Watt and VA ratings of the typical loads are equal.



Examples where a sizing problem can occur

 Consider this case: A typical 1000VA UPS. The user wants to power a 900W heater with the UPS. The heater has a Watt rating of 900W and a VA rating of 900VA with a power factor of 1. Although the VA rating of the load is 900VA, which is within the VA rating of the UPS, the UPS will probably not power this load. That is because the 900W rating of the load exceeds the Watt rating of the UPS, which is most likely 60% of 1000VA or around 600W.

How to avoid sizing errors :Equipment nameplate ratings are often in VA, which makes it difficult to know the Watt ratings. If using equipment nameplate ratings for sizing, a user might configure a system, which appears to be correctly sized based on VA ratings but actually exceeds the UPS Watt rating. By sizing the VA rating of a load to be no greater than 60% of the VA rating of the UPS, it is impossible to exceed the Watt rating of the UPS. Therefore, unless you have high certainty of the Watt ratings of the loads, the safest approach is to keep the sum of the load nameplate ratings below 60% of the UPS VA rating. Note that this conservative sizing approach will typically give rise to an oversized UPS and a larger run time than expected. If optimization of the system and an accurate run time are required, mail me on abobe mentioned mail Address. I Might  have the ability to accurately size your UPS.

Conclusion : Power consumption information on computer loads is often not specified in a way that allows simple sizing of a UPS. It is possible to configure systems that appear to be correctly sized but actually overload the UPS. By slightly over sizing the UPS compared with the nameplate ratings of the equipment, proper operation of the system is ensured. Over sizing also provides the side benefit of providing additional UPS backup time. However, to truly ensure that your UPS is sized properly and that you do not waste money and space on an over-sized unit. So Mail me if you want any guidence for free.
Regards
Gurbinder