Excel Files From Web Won't Open

I had an interesting issue creep up a bit ago with Excel files that were created by a web application not opening in Excel.

I had a ColdFusion app that would generate reports on the fly for users.  We were using CFHEADER and CFCONTENT to deliver table formatted data as XLSX files.  It had been working fine right up until it didn't.  We hadn't made any changes to the code and checked and confirmed that there were no changes/patches to the system since the last known good report was generated.

As it turns out, in mid-July Microsoft upgraded the security in Excel concerning how it handled HTML files with XLS or XLSX extensions from untrusted locations. Previously, Excel would warn you about the file having a type mismatch and would let you accept opening the file.  From the update, Excel would no longer allow the file to be opened and offered no explanation or error message.

There are a couple of workarounds to open the files:
The first is on a file by file basis -

• Once you have the file, Right-Click on it to get the context menu and select ‘Properties’
• On the ‘General’ tab, click ‘Unblock’ and then ‘OK’
• Open the file as usual. You’ll get this message - 'The file format and extension of filename don't match. The file could be corrupted or unsafe. Unless you trust its source don't open it. Do you want to open it anyway?'
• Click ‘Yes’
• The file will open

Another workaround is to change the Trusted Locations settings in Excel

• Open File > Options > Trust Center > Trust Center Settings > Protected View
• Clear the check-marks from  "Enable Protected View for file originating from the Internet" and “Enable Protected View for files located in potentially unsafe locations”.
• Files pulled from the Internet will open.

If you've been building spreadsheets in ColdFusion with CFCONTENT and CFHEADER, it's time to start using CFSPREADSHEET and the associated functions.

Continue reading →

Apple Mobile Devices - Patch 'em Up NOW

Apple has issued an "important security update", iOS 9.3.5, to neutralize a new piece of malware that can remotely jailbreak iPhones allowing an attacker full access to your device to read texts and email, record calls, track your location and activate your phone's camera and microphone.

The update patches the three previously unknown zero-day vulnerabilities that together are referred to as "Trident".

To check if you're at risk look at Settings > General > About > Version   If you're on version 9.3.5 then you're OK.  If you're on a different version you should update now.  You can pull the update through Settings > General > Software Update then just follow the instructions to download and install it.

For those interested we'll go into the details a little:
The three exploited vulnerabilities are:

• CVE-2016-4655, Memory Corruption in Webkit 
• CVE-2016-4656, Information leak in Kernel 
• CVE-2016-4657, Kernel Memory corruption leads to Jailbreak.

The issue was found by cyber security firms Lookout and Citizen Lab, who were tipped off to unusual text messages received by an iPhone user in the United Arab Emirates.
Lookout and Citizen Lab worked with Apple on the patch before releasing information on the vulnerability.
The Trident vulnerabilities are exploited in a spyware package called Pegasus which is widely available throughout the world

Continue reading →