.net pdf 417

.net pdf 417

.net pdf 417

.net pdf 417

.net pdf 417

.net pdf 417,

.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,

.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,

.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,
.net pdf 417,

recognizable Internet worms in history, Code Red and Nimda, both exploited vulnerabilities in Microsoft s IIS web server software) Although such vulnerabilities provided great Low Hanging Fruit for hackers of all skill levels to pluck for many years, the risk from such problems is gradually shrinking for the following reasons: Vendors and the open-source community are learning from past mistakes take the negligible number of vulnerabilities found to date in the most recent version of Microsoft s web server, IIS 7, as an example Users and system administrators are also learning how to con gure web server platforms to provide a minimal attack surface, disabling many of the common footholds exploited by attackers in years past (many of which will be discussed in this section) Vendors have also helped out here by publishing con guration best practices (again, we cite Microsoft, which has published How to Lock Down IIS checklists for some time now) This being said, miscon guration is still a frequent occurrence on the Internet today, especially as web-based technologies proliferate on nonprofessionally maintained systems such as home desktops and small business servers Vendors and the open-source community are responding more rapidly with patches to those few vulnerabilities that do continue to surface in web platform code, knowing with vivid hindsight what havoc a worm like Code Red or Nimda could wreak on their platform Proactive countermeasures such as deep application security analysis products (for example, Sanctum/Watch re s AppShield) and integrated input-validation features (for example, Microsoft s URLScan) have cropped up to greatly blunt the attack surface available on a typical web server Automated vulnerability-scanning products and tools have integrated crisp checks for common web platform vulnerabilities, providing quick and ef cient identi cation of such problems Don t for a minute read this list as suggesting that web platforms no longer present significant security risks it s just that the maturity of the current major platform providers has blunted the specific risks associated with using any one platform versus another Be extremely suspicious of anyone trying to convince you to implement a web platform designed from scratch (yes, we ve seen this happen) Odds are, they will make the same mistakes that all prior web platform developers have made, leaving you vulnerable to a litany of exploits Web server vulnerabilities tend to fall into one of the following categories: Sample les Source code disclosure Canonicalization.

Themes are stored in theme files, which have the thmx extension Themes don t contain any content, just details of the colors and fonts to use and the types of graphical objects to create, so they re compact and quick to download You ll find your themes in the Document Themes folder inside the folder in which you installed Office 2007 For instance, if you installed Office in the Program Files\Microsoft Office folder, the themes are in the Program Files\Microsoft Office\Document Themes 12 folder (The internal version number of Office 2007 is 12) The Document Themes 12 folder contains a Theme Colors folder, a Theme Effects folder, a Theme Fonts folder, and a Microsoft Office Theme file for each of the built-in themes For example, the Technology theme is stored in the file Technologythmx

For more information regarding this vulnerability, you can check out http://www securityfocuscom/bid/149, and you can get patch information from http://www microsoftcom/technet/security/currentasp More recently, Apache was found to contain a canonicalization vulnerability when installed on servers running Windows If the directory that contained the server scripts was located inside the document root directory, you could obtain the source code of the CGI scripts by making a direct request for the script file with, for example, the following unsafe configuration:

You don t need to add themes or Quick Styles to your documents, because Word does that for you As soon as you create a document, you re using the theme that Word has applied to the template attached to the document As soon as you start typing in the document, you re using Quick Styles You can then apply other Quick Styles as needed, or switch to another theme

DocumentRoot "C:/Documents and Settings/http/site/docroot" ScriptAlias /cgi-bin/ "C:/Documents and Settings/http/site/docroot/cgi-bin/"

Normal usage would make a POST request to http://[target]/cgi-bin/foo (note the lowercase cgi-bin ) However, an attacker could retrieve the source to the foo script simply by requesting http://[target]/CGI-BIN/foo (note the uppercase letters) This vulnerability occurs because Apache s request routing algorithms are case sensitive, while the Windows file system is case insensitive The fix for this flaw is to store your server scripts outside of the document tree, a good practice to follow on any web platform Probably the next most recognizable canonicalization vulnerabilities would be the Unicode/Double Decode vulnerabilities, also in IIS These vulnerabilities were exploited by the Nimda worm We discuss these at length in 4 on Windows hacking, so we won t belabor the point here Suffice it to say, again: Keep current on your web platform patches, and compartmentalize your application directory structure We also recommend constraining input using platform-layer solutions such as Microsoft s URLScan, which can strip URLs that contain Unicode- or double-hex-encoded characters before they reach the server

If you don t like the theme Word has applied automatically to a document you ve created, change the theme Choose Page Layout | Themes, and then click the theme you want on the Themes panel If none of the themes appeals to you, click the More Themes On Microsoft Office Online item to open a web browser window to the Microsoft Office Online web site, from which you can download extra themes To load any extra themes you have available (for example, themes your company has developed), click the Browse For Themes item, select the theme file or a document that has the theme applied, and then click the Open button Instead of changing the entire theme, you can change one or two of its three components: theme colors, theme fonts, and theme effects To do so, click the Page Layout tab and go to the Themes group; click the Theme Colors button, the Theme Fonts button, or the Theme Effects button; and then choose the look you want from the resulting panel As with the themes themselves, you can hover the mouse pointer over an item on each of these panels to make Word apply a preview to your document, which helps you find colors, fonts, and effects that suit your needs

.