Chester Wisniewski’s Blog (working at Sophos) describes the use of a GPO to protect you against the exploit. The GPO should disallow the use of executable files that are not on the C: drive. If you need to run executable files from a network drive (old programs?) just specify the specific network paths in the GPO.

The exploit in action

Every installation is different – some use DELL, others HP and some even ACER, so what about creating a batch that can setup folders within the repository for a specific hardware vendor.

A simple batch like this with 4 parameters (make, model, architecture & revision) will create the folder structure for you

Note. If you are deploying DELL machines then just go here and download their CAB files, extract them (using WINRAR) to the newly created folders and finish off with importing them into MDT using the workbench.

So build your base XP image using Virtual PC and do a capture. Now deploy the WIM and during the deployment use the script to inject the storage drivers like you would do in SCCM.

If I count the hours that I’ve spent on written the perfect sysprep.inf file to build my XP Master image and at the end do a capture … damn

Get the script here and give the man some love and respect!

Adobe has now announced, that Adobe Reader will be available in “protected mode” in the next major release (Protected mode has also been used in applications like Internet Explorer, Google Chrome and Microsoft Office 2010). In “protected mode” Adobe Reader will display the PDF file on the PC in a “very restricted manner” inside a sandbox.

Read more on The Adobe Reader and Acrobat Security Initiative here
Read more on Adobe Reader Protected here

This is a buffer overflow in the handling of “itpc:” URLs. Accessing a malicious site through this protocol could lead to remote code execution (itpc URLs are used iTunes to access podcast feeds).

Read more here
Download the updated version here

Before that came out I’ve used a simular setup -> VMware Player and the Browser Appliance from VMware’s Virtual Appliance Marketplace.

Download VMware Player here
and find the Browser Appliance here

The browser is virtualized using Dell KACE’s “Virtual Kontainer” technology and the initial release is for 32-bit versions of Windows 7, Vista, and XP only.

Get the download here (MSI package)

Gotta check it out later today …

• USB Passthrough
• Seriel Passthrough
• vCenter Converter Hyper-V Import

Read more here

One of the things that I’ll look into after the upgrade is the possibility of booting ESXi from SAN (iSCSI, FCoE, and Fibre Channel boot are supported).