New wizard released to create scripts and run Cross Browser Tests

Content has been posted on the new Cloud Testing Blog location – please update your links to http://www.cloudtesting.com/blog/.

http://www.cloudtesting.com/blog/2009/11/25/new-wizard-released-to-create-scripts-and-run-cross-browser-tests/

We’re on the move…

The Cloud Testing Blog is moving to it’s new home at www.cloudtesting.com/blog/.

We hope you like the new fresher look and feel, along with hopefully more content updates.

If you’re an RSS feed subscriber, you’ll need to re-subscribe at: http://www.cloudtesting.com/blog/feed/

RSS Feed of project status out of beta

Subscribers to the Cloud Testing service can take advantage of the new RSS feed of current status for a project, which has moved out of Beta into production.

The feed can be accessed via the home page for a Project:

You can then view updates in your RSS reader of choice – we use Mozilla Thunderbird:

Wireshark 1.2.4 released

An updated version of Wireshark has been released – 1.2.4. Full details are available in the release notes.

It is available in the following formats:

• Windows Installer (32-bit)

• Windows Installer (64-bit)

• Windows U3 (32-bit)

• Windows PortableApps (32-bit)

• OS X 10.5 (Leopard) Intel .dmg

• OS X 10.5 (Leopard) PPC .dmg

• Source Code

from the download page.

Firefox 3.6 beta 3 released

Beta 3 of the 3.6 version of Firefox has been released. It includes 80 fixes compared to Beta 2. For information on what the 3.6 beta 3 update, are available at the release page.

To test your website either functionally or for cross browser compatibility, why not use Cloud Testing.

 

Access to live demo account (read-only)

Cloud Testing is giving access to it’s live demo account for a limited time. All you have to do is visit the Cloud Testing live demo launch page for details of how to access the portal.

The access is restricted to being read-only, so you cannot upload or run new tests, however a Free Trial is available if you would like to do this – just sign up for a Free Trial.

 

Safari 4.0.4 released

This update is recommended for all Safari users and includes improvements to performance, stability, and security including:

* Improved JavaScript performance
* Improved Full History Search performance for users with a large number of history items
* Stability improvements for 3rd-party plug-ins, the search field and Yahoo! Mail

Detailed information on the content of this update is available at the Apple Support Site.

OpenSSL version 1.0.0 Beta 4 released

OpenSSL – The Open Source toolkit for SSL/TLS

http://www.openssl.org/

OpenSSL is currently in a release cycle. The fourth beta is now released.
This is expected be the final or penultimate beta depending on the number
of bugs reported.

The beta release is available for download via HTTP and FTP from the
following master locations (the various FTP mirrors you can find under

http://www.openssl.org/source/mirror.html):

o http://www.openssl.org/source/
o ftp://ftp.openssl.org/source/

The file names of the beta are:

o openssl-1.0.0-beta4.tar.gz
Size: 4000628
MD5 checksum: f22750164e1db42145803fed8104df57
SHA1 checksum: f590232651b9033365e0aa9a2279cdef6519884c

The checksums were calculated using the following command:

openssl md5 < openssl-1.0.0-beta4.tar.gz
openssl sha1 < openssl-1.0.0-beta4.tar.gz

Please download and test them as soon as possible. This new OpenSSL
version incorporates 120 documented changes and bugfixes to the
toolkit (for a complete list see http://www.openssl.org/source/exp/CHANGES).

Also check the latest snapshots at ftp://ftp.openssl.org/snapshot/
or CVS (see http://www.openssl.org/source/repos.html) to avoid
reporting previously fixed bugs.

Since the third beta, the following has happened:

- Initial TLS session renegotiation fix
- TLS ticket and SNI coexistance fix
- Several DTLS fixes and updates.
- Custom OCSP headers.
- Check return values properly on some functions.
- Some documentation for X509 chain verification functions.
- Time routines fixed for CRL generation.
- Additional PRNG duplication protection.
- Cross compilation updates.
- Build system fixes including VMS.
- Other bug fixes.

Reports and patches should be sent to openssl-bugs@openssl.org.
Discussions around the development of OpenSSL should be sent to
openssl-dev@openssl.org. Anything else should go to
openssl-users@openssl.org.

The best way, at least on Unix, to create a report is to do the
following after configuration:

make report

That will do a few basic checks of the compiler and bc, then build
and run the tests. The result will appear on screen and in the file
“testlog”. Please read the report before sending it to us. There
may be problems that we can’t solve for you, like missing programs.

Yours,
The OpenSSL Project Team…

Mark J. Cox Ben Laurie Andy Polyakov
Ralf S. Engelschall Richard Levitte Geoff Thorpe
Dr. Stephen Henson Bodo Möller Ulf Möller
Lutz Jänicke Nils Larsch

Firefox 3.5.5 released

The latest update to the Firefox 3.5 version has been released. It contains fix fixes, three of which are critical. For full details of the release see the Bug List from Mozilla, or the Firefox 3.5.5 Release Notes.

No update for the 3.0 version of Firefox was made.

 

Cloud Testing has updated it’s cloud testing agents with this release.

For a full list of browsers supported by the Cloud Testing functional website testing service, visit the Cloud Testing website at www.cloudtesting.com.

 

 

Apache/mod_ssl vulnerability and mitigation

The following announcement has just been made to the announce mailing list:

Apache httpd is affected by CVE-2009-3555[1] (The SSL Injection or MiM attack[2]).

The Apache httpd webserver relies on OpenSSL for the implementation of the SSL/TLS protocol.

We strongly urge you to upgrade to OpenSSL 0.9.8l; and to be prepared to deploy OpenSSL 0.9.8m as it becomes available[3].

Note that these are for short term and mid-term mitigation only; the long term solution may well require a modification of the SSL and/or

TLS protocols[4].

For those who are not able to upgrade OpenSSL swiftly and/or for those who need detailed logging – we recommend that you roll out

this patch[5]:

http://www.apache.org/dist/httpd/patches/

apply_to_2.2.14 CVE-2009-3555-2.2.patch

sha1: 28cd58f3758f1add39417333825b9d854f4f5f43

as soon as possible. This is a partial fix in lieu of the protocol issues being addressed and further changes to OpenSSL. Like the

OpenSSL 0.9.8l stopgap measure this patch rejects in-session renegotiation.

If you are unable to patch and unable to roll our a newer version of OpenSSL, and you rely on Client Side Authentication with Certificates

then we recommend that you 1) ensure that you limit your configuration to a single ‘SSLClient require’ on VirtualHost/Sever level and 2)

remove all other (re)negotiation/require directives. However this does NOT fully protect you – it just curtails authentication in this

specific setting.