Captain's Blog

Shavlik NetChk Protect 7 has been released

Shavlik NetChk Protect 7 has been released and is available for download from our web site.  I am personally very excited about this release as it fulfills the next phase of my vision of a high performance systems and security management solution built on a zero or one agent architecture.  This is critical to users who need that flexibility, which is everyone really, but what our customers need to know is the agent in NetChk Protect 7 is also one of the industry’s most flexible, high performing agents available.

 

As I spoke about in an earlier post, we have licensed Sunbelt’s VIPRE antivirus engine and integrated it with NetChk Protect 7, and it is a key component of the Shavlik Security Suite.  So now users can now setup one system and get patch management and end-point protection at the same time, without having to pay extra for AV.

Thanks to a great group of customers, we had a high participation in our beta program, and their positive feedback on the new and enhanced features and they are excited to upgrade to the new version.

And as always a ton of thanks to all our employee who made this product happen!

Shavlik NetChk Compliance

Thank you to tritterbrew for his great overview on our Shavlik NetChk Compliance product

Shavlik NetChk Pro Plus 5.8 is released

Shavlik NetChkPro Plus 5.8 is released!  Its not yet publicly announced, that will be coming soon.  Its new items are integrated agents with the agent-less, remote consoles and multiple-site database roll up for reporting.  Also included are delegation and patch policy based management and a number of other features based on extensive customer feedback.

We will be releasing the Protect (patch and spyware version) of this product shortly after the Patch only version.

This release is designed to meet the needs of over 6,000 customers, more than double of the next Pure Play Patch ISV - all of us at Shavlik Technologies thank you for your input and support for making us the market leader.

More Shavlik NetChk Protect 5.8 features

Download Shavlik_NetChk_Protect.pdf this document overviews our upcoming new release.  This new product greatly increases our ability to provide security management to large and difficult to manage networks.

short update

I just got back from a week of R&R, well at least some R&R as my blackberry was ever present.

Looks like more MS06-40 news

Also, my survey was closed while I was gone, its back on-line now.

Our upcoming 5.8 release for Shavlik Netchk Protect and Shavlik NetChkPro Plus is in beta, it adds integrated, home grown agents, corporate wide spyware reporting, distributed patch scanning, remote patch and spyware management, laptop support,, Shavlik results database roll-up and other features.  As the release draws near we will provide much more detail on this release and related corporate directions as we head into 2007.

Shavlik Survey (SSL Based)

I wrote up a survey at https://www.surveymonkey.com/s.asp?u=394252488617

Please take 5 minutes to answer a few questions if you have the time.  It really helps us build the right products and company for you.

The survey is SSL encrypted and you do not need to give us your name etc unless you want to.

I will post results once there is some solid data.

Thank you,
Mark

 

August Patch Details

From Eric Schultze, our patch expert:

Looks like MS06-040, MS06-041, MS06-042 are most "dangerous" in sense that they might be "wormable" in combination. Exploit code exists in the wild for MS06-040 - so this is the one that might be most important to install first.  Although of these 12 bulletins, I'd say 9 or 10 of them are "very high priority" for testing and deployment ASAP. (Least concerned about MS06-044, MS06-045, MS06-049)

(** means exploit code exists for this issue)

** MS06-040 - Remote buffer overflow in Server Service.  Exploit code exists in the wild for this issue - improtant to patch this one right away.  Server service provides file an printer sharing and logon services to both workstations and servers. Only known workaround is to block ports 139 and 445. All Operating Systems at risk, although Windows 2000 systems may be most at risk.  Different vuln than in MS06-035 (both must be installed to fully protect)

MS06-041 - DNS - Requires user to load/preview specially crafted email/website. Registry modification workaround is available in the security bulletin. This attack will only work on the local subnet. Potential worm combination. Affects all Windows releases.

** MS06-042 - IE rollup - fixes 7 vulns total of which 4 remotely exploitable - 1 publicly disclosed with proof of concept code. Will probably become a major spyware vector. Affects all supported IE versions.

** MS06-043 - Outlook Express 6/MHTML parse error - In order to be exploited, a user must view a malicious web page or read an evil html-formatted email. Publicly reported.  Proof of concept code has been released.

MS06-044 - MMC embedded HTML parse error - Affects Windows 2000 only. IE6 SP1 lessens impact - In order to be exploited, a user must view a malicious web page or read an evil html-formatted email

MS06-045 - This is a bug in drag and drop event handling.  This is rated important and impacts all Operating Systems.  As a workaround, you can disable WebDAV to eliminate vuln until patch is applied. Requires user to OK several post-exploit actions in order to exploit a system

MS06-046 - This is a vulnerability in Active X HTML help control.  As a workaround, you can disable HTML help, prompt for ActiveX.  In order to be exploited, a user must view a malicious web page or read an evil html-formatted email.  This exploit has been publicly disclosed, though no proof of concept code has been released at this time.

** MS06-047 - Visual Basic for Apps - Affects Office XP and Office 2000 and related components.  In order to be exploited, a user must open a malicious Office document.  This issue has been publicly disclosed and is being actively exploited on the Internet.

** MS06-048 - PowerPoint  This issue affects Powerpoint 2000, XP, 2003 + Mac.  In order to be exploited, a user must open a malicious Office document.  This issue has been publicly disclosed and is being actively exploited on the Internet.

MS06-049 - Kernel issue.  This impacts Windows 2000 only.  Attacker must log on to the system in order to exploit this issue.  This is a privilege escalation vulnerability where a user may elevate their permissions to that of administrator.

MS06-050 - Hyperlink Object Library.  This affects all Operating Systems.  A user must click malicious link in order to be exploited.  As a workaround, you can disable hyperlink clicking via registry (though this may confuse users)

MS06-051 - remote kernel exploit.  This affects all Operating Systems. 2 vulns - User profile elevation only affects Windows 2000 and requires the attacker to logon to the system. The second issue is an unhandled exception and requires user to visit malicious web site

Our Free Products, including network scan for MS06-040

Short update: please take a minute to help me with our product planning and take this security products/features survey I created.

Since 2000 we have provide some level of free security products, including MBSA which is our software jointly released with Microsoft.  Now that Microsoft is moving away from its support of legacy product support we are going to back to our model in which we directly release free software instead of doing it only via Microsoft. These free products are used by over 120,000 business from small to large, they cover security patch management, patch management, compliance management, vulnerability management, corporate spyware management in a unifying way.  All our patching products are based on the HFNetChk engine. Compliance management Operations Edition product is a host based scanner that includes automated remediation beyond patching.  The patch management products below will scan networks for MS06-040, the most critical patch out there right now.

Update: I sometimes am told that giving away free products may make larger customers see us a smaller company product, which we are not of course.  Mainly our competitors drive this thought I would guess but regardless of its source its something I should address.  I choose to give away free products because it puts professional level of security products in the hands of many people with smaller budgets, or no budget, or for those who want to try out software for a long period before they buy.  Often these users are forced to use sub-standard free products. Such users exist even in the largest companies I believe, not just the small business and home users, I also believe that the more users we have for our products the more sales we get at the end of the day so there is a business driver too.  The fact that the largest companies in the world are users of our technology shows it works there, but I am also happy to see that our focus and extra work done by our design and engineering teams to create easy to use, yet very powerful products is working well.  Maybe that is something our competitors do not want people to think about... Just a guess.  Also, some of our free products offers expire because they are more focused on introducing new products, these offers tend to give away large(r) network supporting solutions.

Here is where we are today with our free products. (in line updates)

1. Free, unlimited no time out scanning as a full, updated version of our MBSA patch management scanning engines.  Go to our Microsoft replacement page to find more about this or go to our products download page and get the "Shavlik NetChk Analyzer for Microsoft", you will need to change the default drop down to get this specific product.  This product does not time out and it is a fully scriptable network scanner, its free and it finds all the current Microsoft patches.  This product is free due to recent changes where Microsoft is not going to support as much with MBSA as it used to, and it can only its for internal customer use only.  This offer was to expire today (Sept 30 06) but with all the 0-days and out of band patches we are keeping it around a while. We also sell a much more featured version which has an extended trial mode, download Shavlik NetChk Analyzer.  These are the latest version of HFNetChk.
    
2. We also have a free for one year up to 50 computer Spyware management product, built on the same GUI and engines as our patching product.  Download "Shavlik NetChk Spyware" for this product.  This is a corporate product and is not designed for home use. Read more.  This offer expires UPDATE: watch this date, its coming soon: Sept. 30, 2006, this is a high value free product we are giving out to show the corporate value of our spyware product.
3. You can also get our free combined security patch management and corporate spyware management GUI based product for up to 10 computers, good for one year.  Download Shavlik NetChk Protect. Read more.   This offer is available until our 5.8 product releases (soon), upon the release of 5.8 we may change this policy.  This is also a high value product but its limited to 10 computers.  This product is free for small businesses and mid to large business who want to try us out for the long term in labs or small groups to get a low risk start.
4. You can get our Compliance management Operations Edition product, free for up to 10 computers for year, this is a GUI based product that scans and remediates top security issues on your Microsoft network. Download "Shavlik NetChk Compliance Operations Edition". Read more.  As of right now we do not have and end date for this free offer.  This product has a free version to cover small business and to also give mid to large business a chance to work with us in a long term, low risk way.

Windows NT Patches Still In-use

As noted here and else where, the U.S. Department of Homeland Security has urged Windows users to plug a potential worm hole in the Microsoft operating system (MS06-040). While this vulnerability can impact all of the Microsoft operating systems, fixing this problem on Microsoft Windows NT(R) is particularly challenging.

Shavlik Technologies has a solution to automatically remediate against these recently announced vulnerabilities on Windows NT 4.0 and other systems.

Learn more about the program offering and view answers to frequently asked questions here:

http://www.shavlik.com/custompatch.aspx

or contact Shavlik Technologies at NTPatches@Shavlik.com or call us at (800) 690-6911.

Background:

Microsoft officially ended security patch support for Windows NT 4.0 on December 31, 2004, however, they continue to create and ship security patches for NT 4.0 via their Custom Support Agreement. Shavlik Technologies’ customers who have a Microsoft Custom Support Agreement for NT 4.0 patches may request and obtain Shavlik support for assessing and deploying these security updates.

For information on the Homeland Security announcement see:

http://news.com.com/Homeland+Security+Fix+your+Windows/2100-7348_3-6103805.html?tag=nefd.top

Dept. Homeland Security patch warning

DHS requesting patch update for MS06-040