My colleague Feliciano has just made me aware of an extraordinary security bulletin we have just released for a new vulnerability discovered in ATL libraries which could allow remote code execution; here are the information I am aware of so far: Microsoft Security Advisory (973882) English Rilascio straordinario di sicurezza Microsoft del 28 luglio 2009: prime indicazioni e raccomandazioni (Feliciano’s post, if you can read Italian) The updates to install: MS09-034 MS09-035 (for developers, update for Visual Studio)   Carlo Quote of the day: Those who dream by day are cognizant of many things which escape those who dream only by night. – Edgar Allan Poe

I recently came across an odd problem the customer got on his SharePoint server: when the clients had the Office Live add-on installed they were constantly refused with a 403 error. The problem is well described here. If you have this problem, there is a fix for you: 970946. If you do not want to install the fix, you might consider to filter the UserAgent string you receive on the server (well, you should filter it before the web request is processed on the server) as one of my customers is testing: if the UserAgent string contains the word “Mozilla” and “Office”* or “non-browser” or “FrontPage”*, just remove the unwanted token.   Carlo Quote of the day: All things are difficult before they are easy. – Thomas Fuller

Things keep moving and after some discussion (here and here I already expressed my view on the matter), the first KB article with a “Fix it” button to directly download the relevant hotfix has gone live a couple of days ago, check it out: http://support.microsoft.com/kb/945402/en-us. Carlo Quote of the day: Committee–a group of men who individually can do nothing but as a group decide that nothing can be done. – Fred Allen

Every now and then the question comes back in the limelight: “Why some hotfixes are publicly available to download, but most of the times I have to call CSS to get one?” and “Wouldn’t be easier if we could just download the fix ourselves? At least we would save time, since we’ll get it anyway from CSS” and again “Who decides if a fix has to be public or private? How?” etc…, feel free to add more if you have (and I’m sure some of you do! 😉). I discussed this topic internally with my colleagues (both Support Engineers and Escalation Engineers) in CSS EMEA and of course there are some different views on it, but there is also a common understanding about some of the principles behind the policy Microsoft adopted. Those “private” fixes do not undergo the same amount of tests that Service Packs or “public” fixes have to pass, and this is the main reason (basically: costs); one of the parameters the Product Team(s) takes into account when producing a fix is the business impact that issue is having (or potentially will have) on customer’s applications, but also the risk of introducing regression bugs, the amount of code to…