jn1kk's questions

I am trying to fix CVE-2016-2107.

I consulted several sites, which do not seem to provide a clear answer for all cases:

I use Apache2 2.4.12 with PHP 5.5.26.

I ran: apt-get install openssl libssl-dev and sudo apt-get install libssl1.0.0.

It installed new OpenSSL but Apache/PHP still uses old installation, phpinfo() shows:

openssl OpenSSL support enabled OpenSSL Library Version OpenSSL 1.0.1f 6 Jan 2014 OpenSSL Header Version OpenSSL 1.0.1f 6 Jan 2014

Proof new OpenSSL is installed:

ubuntu@ip-xxxxx:/usr/bin$ openssl version OpenSSL 1.0.2h 3 May 2016

dpkg -l | grep ssl ii libflac8:amd64 1.3.0-2ubuntu0.14.04.1 amd64 Free Lossless Audio Codec - runtime C library ii libgnutls-openssl27:amd64 2.12.23-12ubuntu2.2 amd64 GNU TLS library - OpenSSL wrapper ii libio-socket-ssl-perl 1.965-1ubuntu1 all Perl module implementing object oriented interface to SSL sockets ii libnet-smtp-ssl-perl 1.01-3 all Perl module providing SSL support to Net::SMTP ii libnet-ssleay-perl 1.58-1 amd64 Perl module for Secure Sockets Layer (SSL) ii libssl-dev:amd64 1.0.2h-1+deb.sury.org~trusty+1 amd64 Secure Sockets Layer toolkit - development files ii libssl-doc 1.0.1f-1ubuntu2.15 all Secure Sockets Layer toolkit - development documentation ii libssl1.0.0:amd64 1.0.1f-1ubuntu2.19 amd64 Secure Sockets Layer toolkit - shared libraries ii libssl1.0.2:amd64 1.0.2h-1+deb.sury.org~trusty+1 amd64 Secure Sockets Layer toolkit - shared libraries ii openssl 1.0.2h-1+deb.sury.org~trusty+1 amd64 Secure Sockets Layer toolkit - cryptographic utility ii python-openssl 0.13-2ubuntu6 amd64 Python 2 wrapper around the OpenSSL library ii ssl-cert 1.0.33 all simple debconf wrapper for OpenSSL

apt-cache policy libssl1.0.2. libssl1.0.2-dbg: Installed: (none) Candidate: 1.0.2h-1+deb.sury.org~trusty+1 Version table: 1.0.2h-1+deb.sury.org~trusty+1 0 500 http://ppa.launchpad.net/ondrej/php5/ubuntu/ trusty/main amd64 Packages

ubuntu@ip-xxxxx:/usr/bin$ apt-cache policy libssl-dev libssl-dev: Installed: 1.0.2h-1+deb.sury.org~trusty+1 Candidate: 1.0.2h-1+deb.sury.org~trusty+1 Version table: *** 1.0.2h-1+deb.sury.org~trusty+1 0 500 http://ppa.launchpad.net/ondrej/php5/ubuntu/ trusty/main amd64 Packages 100 /var/lib/dpkg/status 1.0.1f-1ubuntu2.19 0 500 http://us-east-1.ec2.archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages 500 http://security.ubuntu.com/ubuntu/ trusty-security/main amd64 Packages 1.0.1f-1ubuntu2 0 500 http://us-east-1.ec2.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages

Can someone please help me tell Apache/PHP about the new OpenSSL installation? Thanks!

We currently use Google as an OpenID identity provider to our web platform. We need to move away from it. I discovered Amazon Cognito (we already use EC2/S3 and the rest).

I discovered the well_known here: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_UxUwcIy3y/.well-known/openid-configuration

Then I fetched the authorization_endpoint which is https://cognito-idp.us-east-1.amazonaws.com/us-east-1_UxUwcIy3y.

However, no matter what I pass to it, including response_type, scope, client_id, redirect_uri, it always gives me:

{"code":"BadRequest","message":"The server did not understand the operation that was requested.","type":"client"}

With no other information.

There doesn't seem to be any public documentation regarding this feature. Is what I'm trying to do even possible (make Cognito act like Google OpenID IDP)? Does anyone have any documentation regarding what to pass to authorization_endpoint. I understand that the Amazon Cognito Mobile SDK provides a way to embed SSO in apps, but maybe it is not possible to do this directly the way I'm doing. I already setup a user pool.

I have an EC2 instance with Windows Server 2012 R2 with all the latest updates.

I made a service at first, and then a task to run a batch file to create a Microsoft Word report (using my custom C# program). I set the task to run with highest privileges and to be run as Administrator. While my batch file does get called, it fails. My batch file:

C:/WordGenerator.exe C:/report.docx > C:/word.log 2>&1

It errors out with an exception from the exe:

Failure
System.NullReferenceException: Object reference not set to an instance of an object.
    at InteropFunctions.Save(String opath)
    at Reporting.Report.generate()
    at Reporting.WordGenerator.run()

If I run the batch file manually, it finishes fine.

The above exception occurs when C# Word interop function tries to open a made report for further processing (so it effectively doesn't have permissions - can't find it).

1. What I learned so far it that Windows may still run all services as the LOCAL SYSTEM account, and logs in to the given user (if any) on the fly.

2. I also learned that services may run in a different sessions/security context as regular Administrator commands.

Can anyone help find a solution that works? I need to run a batch file on startup as Administrator (without login). I willing to go as far as simulating a login. We are experiencing other issues due to this not really being run as Administrator (what I gave was a simple case). Pictures for setup: