Wow, strangely enough that works. I've verified this fix on 2 systems here.
So the new best way to fix this, as you said is to:
in Run Dialog, at command prompt, or in Start Menu search box, paste,
and press return.Code:notepad "%userprofile%\AppData\Local\Microsoft\Windows Live\Services\Cache\Config.xml"
File > Save or Ctrl+S
Place gadget back on desktop, restart sidebar.exe, or wait for existing gadgets to become operational.
Been looking for a solution to this issue for over a week now and I can verify that jewishnigra's solution works.
Close the weather gadget and go to:
%userprofile%\AppData\Local\Microsoft\Windows Live\Services\Cache\Config.xml
Open Config.xml with Notepad then File -> Save/Ctrl+S. Reboot or restart sidebar.exe and wha la!
*edit* - Can someone sticky this thread?
A word of caution if more eyes are going to be seeing this...
Using gadgets provides your machine an easy target for attack. The vast majority of gadgets do not implement secure code so if you do not trust either the route to the server or the server itself that the gadget is connecting to, then don't use gadgets. A "coffee shop pineapple" can see gadget traffic and spoof the update server so he can inject his own code as your "update." And, since there's no security certificate mismatch warning because everything is happening over plain-text, the entire attack can be performed covertly in the background. This was well documented over 2 years ago. Take a look around youtube for some hilarious PoC's. Microsoft didn't want to deal with it because I'm assuming that would mean an entire overhaul of the gadget platform to act more like a traditional browser with anti-XSS protection and the prevention of accessing any ActiveX object or PowerShell script. At that time, they were focused on "Metro" apps anyway. #cringe
It's a shame too because of the usefulness of internet-related gadgets. If you still REALLY want to use gadgets then I would suggest only using "local" gadgets and setup a firewall rule to block all outgoing traffic from sidebar.exe. To me, it's a classic case of too much usability access has resulted in glaring security issues.
I read some think the security issue is overblown. I don't even have the Config.xml. I installed 8gadgetPack and I am using the weathercenter app without any issues.A word of caution if more eyes are going to be seeing this...
Using gadgets provides your machine an easy target for attack. The vast majority of gadgets do not implement secure code so if you do not trust either the route to the server or the server itself that the gadget is connecting to, then don't use gadgets. A "coffee shop pineapple" can see gadget traffic and spoof the update server so he can inject his own code as your "update." And, since there's no security certificate mismatch warning because everything is happening over plain-text, the entire attack can be performed covertly in the background. This was well documented over 2 years ago. Take a look around youtube for some hilarious PoC's. Microsoft didn't want to deal with it because I'm assuming that would mean an entire overhaul of the gadget platform to act more like a traditional browser with anti-XSS protection and the prevention of accessing any ActiveX object or PowerShell script. At that time, they were focused on "Metro" apps anyway. #cringe
It's a shame too because of the usefulness of internet-related gadgets. If you still REALLY want to use gadgets then I would suggest only using "local" gadgets and setup a firewall rule to block all outgoing traffic from sidebar.exe. To me, it's a classic case of too much usability access has resulted in glaring security issues.
What port(s) does sidebar use?
Well, you can believe what you want.
Depending on your IE or proxy configuration settings, 0 to 65535. Sidebar is an IE process.
https://technet.microsoft.com/library/security/2719662Using gadgets provides your machine an easy target for attack
It doesn't really say "How?"
Jewishnigra you just brought up another security concern for windows 7 users. Since Sidebar is an IE process doesn't that make Internet explorer just as vulnerable?
I still say it is odd Microsoft is not willing to patch the gadget issue. Just my opinion.
That is CONFIRMED! It WORKS! Some dude on MS community suggested overwriting this file and a whole load of other folders and files from a Windows 7 system with working gadgets, but that was an overkill and you needed a second system.
That's fine with me. I don't do online shopping nor do I transfer billions of dollars from my PC (actually I prefer real money in my pocket, even for larger amounts, for obvious reasons). What else can these so called "attacks" do to me?
I think this whole security thing is exaggerated, at least for the home user. The worst that can happen for me is a destructive or annoying virus (using RAM or CPU, deleting files etc.), but those are easily avoided with a good antivirus and even if infected, it still usually takes no more than an hour to disinfect, for those rare cases when I do get infected, and last, but not least, my most important files are just fine on my backup external device, so why this whole "security" craziness?
I'm here 6-8 hours per day, every day since Win7 beta without missing a day, and am still waiting to see a single case of infection traced to gadgets.
Maybe if we wait a little longer?
This fix works for the Weather gadget,but did not fix my currency gadget
.
Anyone figure that one out yet?
Thanks
Quote