Daily Archives: November 10, 2008

IntelliJ IDEA 8.0

Posted on by

JetBrains has released IDEA 8.0. It has support for a few new frameworks like JBoss Seam, Struts 2, GWT 1.5, RESTful webservices and updated support for Spring like Spring 2.5, Spring Webflow, Spring MVC and Spring Dynamic Modules. Templates languages like FreeMarker and Velocity are now supported as well as improved support for XPath and XSLT.

In version 7.0 JetBrains introduced support for Maven which has been further enhanced in 8.0:

  • Creating new projects from Maven archetypes.
  • Resource filtering with built-in Make.
  • Manually added libraries and modules dependencies support.
  • Completion of artifacts’ groupId, artifactId, version, exclusions, based on downloadable repository indices.
  • Code completion for plugin configuration.
  • Parent and dependencies generation in pom files with Alt+Insert.
  • Add Maven Dependency Quick Fix for unresolved classes in java code.
  • Support for Web Overlays.


This makes IDEA 8 the best choise for the development of mavenized projects.

Additionally the built-in Subversion connector has been updated for Subversion 1.5 and has support for merge-tracking.

References

Openfire Server Multiple Vulnerabilities

Posted on by

Andreas Kurtz has published a security advisory regarding multiple critical security vulnerabilities in Openfire‘s admin console. There is also a posting to full-disclosure.

The issues allow a remote attacker to circumvent authentication and run arbitray code with the permissions of the user running Openfire. It affacts all versions up to and including 3.6.0a.

Andreas claims to have notified the vendor Jive Software six months ago. Up to now no security advisory has been issued by Jive and no patch has been published. I am really interested to hear Jive’s version of this story. If it is true that Jive was aware of the issues for so long and no action has been taken to inform the community or to fix the problem this will probably result in a loss of trust in Openfire’s development model.

For now the only solution is to limit access to the admin console by firewall rules. With regard to security issues in the admin console in the past this is recommended anyway. The XMPP interface is not accected by the vulnerabilities discovered by Andreas.

Update 2008-11-14

Openfire 3.6.1 has been released that fixes the security issues.

References