September 2007

MWR InfoSecurity have released a whitepaper titled:

"Considerations for the Secure Rollout of Sidebar Gadgets in Windows Vista"

This paper gives an overview of Vista gadgets with details on possible attack scenarios and mitigation.  This comes at a time when a number of Vista gadgets have had flaws released into the public domain.  MWR are currently coordinating with the vendors of a number of vulnerable popular Vista gadgets.

The paper is available at:

http://www.mwrinfosecurity.com/publications/mwri_sidebar-gadgets_2007-09-25.pdf

This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.