When Oracle released Java 7 Update 45 several months ago, I noticed a strange behavior - if the user decides not to update Java, the uploader starts working incorrectly (although it was working great a day ago).
On December 29 2011 Microsoft published security update Microsoft Security Bulletin MS11-100 - Critical. The security update has been released to fix ASP.NET DoS vulnerability. The update puts a limit to number of key-value pairs that can be sent in a single HTTP POST request. By default not more than 500 variables can be uploaded per one request.
If you open "Start" menu in 64-bit Windows platform you will notice interesting thing - there are two shortcuts for Internet Explorer: "Internet Explorer" and "Internet Explorer (64-bit)".
As you probably noticed, we have released Image Uploader 6.1 on these weekends. The main reason we did it is to fix the security vulnerabililty reported to us by Microsoft.
In the Internet Explorer 8 developers’ blog I found very interesting post IE8 Security Part II: ActiveX Improvements.
All of you who read our blog knows a lot about killbit for Image Uploader and Microsoft Security Advisory (953839) that stoppes using of unsafe versions.
It turned out that vulnerabilities in Image Uploader caused not just killbit problem, but it led to one more aftermath. We are getting more and more complaints from our customer that end users experience issues with Image Uploader if they have Norton Antivirus installed.
As I announced a week ago, Microsoft has released security update which includes killbits for old vulnerable builds of Image Uploader.
Only one week left before Microsoft release Cumulative Security Update for ActiveX killbits. They scheduled it for August 12, 2008 at approx 10am PST.
In my previous post I have mentioned about release of Image Uploader 5.1 (and 4.7) which has a number of security fixes (few known heap overflow and a bunch of potential problems). To prevent malicious persons to exploit these issues, we are releasing a killbit for all version and strongly recommend each customer of Image Uploader to get an update (which is free for appropriate major build).