Microsoft urges deployment of ASP .NET patches ASAP

In its latest security bulletin, Microsoft is specifically emphasizing .NET Framework patches.

If ignored or left unpatched, the targeted flaws could lead to an elevation of privilege attack, the software conglomerate noted.

The "critical" out-of-band bulletin, released Dec. 29, consists of one publicly disclosed issue and three privately disclosed holes, all found in Microsoft's framework for ASP.NET.


Related coverage:

SSL flaw could allow hijacking of 'secure' Web sessions


According to Microsoft's security bulletin summary, one of the most critical of issues being addressed by the patch is the ability of an attacker to gain access to a user's account on an ASP.NET-based website if a specially crafted Web link were clicked. To successfully exploit this vulnerability, the hacker would also need to know the specific user name being targeted.

The versions of .NET software supported by the update (running on any supported version of Windows) include Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5 Service Pack 1, Microsoft .NET Framework 3.5.1 and Microsoft .NET Framework 4.

The bulletin fixes these flaws "by correcting how the .NET Framework handles specially crafted requests, and how the ASP.NET Framework authenticates users and handles cached content," wrote Microsoft.

Microsoft's Pete Voss Sr., response communications manager with the Trustworthy Computing Group, discussed how the flaws in .NET Framework could potentially be found in other software.

"This is an industry-wide issue that could affect a broad spectrum of technologies," said Voss in a Dec. 30 webinar. "Since ASP.NET was at the greatest risk because of the public disclosure, we have focused our efforts so far on making sure we secure ASP.NET. We are actively investigating other technologies where this could be vulnerable and so far we do not think that classic ASP is vulnerable. Information on other affected technologies will be revealed as the issue develops."

Voss also clarified that shops "that are internet-facing and accept input from unauthenticated or untrusted user provided content" are at risk more than internal servers. He suggests these shops should deploy as soon as proper testing is complete.

Featured

  • Pierce County

    CARES dashboard ensures county spending delivers results

    The CARES Act Funding Outcomes Dashboard helps Pierce County, Wash., monitor funding and key performance indicators for public health emergency response, economic stabilization and recovery, community response and resilience, and essential government services.

  • smart city challenge

    AI-based traffic management improves mobility, saves fuel, cuts pollution

    Researchers are developing a dynamic feedback traffic signal control system that reduces corridor-level fuel consumption by 20% while maintaining a safe and efficient transportation environment.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.