News

Microsoft Releases Out-of-Band Patch for .NET Vulnerability

A recently released Microsoft security bulletin targeted flaws in Microsoft .NET Framework which, if unpatched, could lead to an elevation of privilege attack.

The "critical" out-of-band bulletin, released on December 29, consists of one publicly disclosed issue and three privately disclosed holes, all found in Microsoft's framework for ASP.NET.

According to Microsoft's security bulletin summary, one of the most critical of issues being addressed by the patch is the ability of an attacker to gain access to a user's account on an ASP.NET-based Web site if a specially crafted Web link were clicked. To successfully exploit this vulnerability, the hacker would also need to know the specific user name being targeted.

The versions of .NET software supported by the update (running on any supported version of Windows) include Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5 Service Pack 1, Microsoft .NET Framework 3.5.1 and Microsoft .NET Framework 4.

The bulletin fixes these flaws "by correcting how the .NET Framework handles specially crafted requests, and how the ASP.NET Framework authenticates users and handles cached content," wrote Microsoft.

Microsoft's  Pete Voss, Sr., response communications manager with the Trustworthy Computing Group, discussed how the flaws in .NET Framework could potentially be found in other software.

"This is an industry-wide issue that could affect a broad spectrum of technologies," said Voss in a December 30 webinar. "Since ASP.NET was at the greatest risk because of the public disclosure, we have focused our efforts so far on making sure we secure ASP.NET. We are actively investigating other technologies where this could be vulnerable and so far we do not think that classic ASP is vulnerable. Information on other affected technologies will be revealed as the issue develops."

Voss also clarified that shops "that are internet-facing and accept input from unauthenticated or untrusted user provided content" are at risk more than internal servers. He suggests these shops should deploy as soon as proper testing is complete.

 

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Clarifies Project Cortex's Scope, IT Controls and Product Delivery in Q&A

    Microsoft recently offered a Q&A session on Project Cortex, its emerging "knowledge network" solution for Microsoft 365 users.

  • How To Use .CSV Files with PowerShell, Part 2

    In the second part of this series, Brien shows how to import a .CSV file into a PowerShell array, including two methods for zooming in on just the specific data you need and filtering out the rest.

  • Windows 10 Preview Adds Ability To Display Linux Distro Files

    Microsoft on Wednesday announced Windows 10 preview build 19603, which adds easier access to installed Linux distro files using Windows File Explorer.

  • Microsoft 365 Business To Get Azure Active Directory Premium P1 Perks

    Subscribers to Microsoft 365 Business (which is being renamed this month to "Microsoft 365 Business Premium") will be getting Azure Active Directory Premium P1 licensing at no additional cost.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.