News

Bulletin Released for ASP.NET Security Flaw

The vulnerability in the .NET Framework could lead to elevation of privilege attack.

Microsoft recently took the unusual step of releasing an "out-of-band" security bulletin for a hole in its .NET Framework.

Out-of-band fixes are released when a flaw is deemed so severe that waiting until the normal "Patch Tuesday" security bulletins could be catastrophic for some organizations.

In this case, the flaw could lead to an elevation of privilege attack. The bulletin, released on December 29, consists of one publicly disclosed issue and three privately disclosed holes, all found in Microsoft's framework for ASP.NET.

According to Microsoft's security bulletin summary, one of the most critical of issues being addressed by the patch is the ability of an attacker to gain access to a user's account on an ASP.NET-based Web site if a specially crafted Web link were clicked. To successfully exploit this vulnerability, the hacker would also need to know the specific user name being targeted.

The versions of .NET software supported by the update (running on any supported version of Windows) include Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5 Service Pack 1, Microsoft .NET Framework 3.5.1 and Microsoft .NET Framework 4.

The bulletin fixes these flaws "by correcting how the .NET Framework handles specially crafted requests, and how the ASP.NET Framework authenticates users and handles cached content," wrote Microsoft.

Microsoft's  Pete Voss, Sr., response communications manager with the Trustworthy Computing Group, discussed how the flaws in .NET Framework could potentially be found in other software.

"This is an industry-wide issue that could affect a broad spectrum of technologies," said Voss in a December 30 webinar. "Since ASP.NET was at the greatest risk because of the public disclosure, we have focused our efforts so far on making sure we secure ASP.NET. We are actively investigating other technologies where this could be vulnerable and so far we do not think that classic ASP is vulnerable. Information on other affected technologies will be revealed as the issue develops."

Voss also clarified that shops "that are internet-facing and accept input from unauthenticated or untrusted user provided content" are at risk more than internal servers. He suggests these shops should deploy as soon as proper testing is complete.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

comments powered by Disqus

Featured

  • VS Code Python Tool Does Multiple Interactive Windows

    Code cells from Python scripts by default will still be executed in a same interactive window, but developers can now configure the Python extension to run separate files in separate interactive windows.

  • VS Code Java Team Improves 'Getting Started' Experience

    Microsoft's dev team responsible for the Java on Visual Studio Code extensions released a new update that eases the "getting started" experience, addressing feedback from new users who want an easier onramp.

  • Data Prep for Machine Learning: Encoding

    Dr. James McCaffrey of Microsoft Research uses a full code program and screenshots to explain how to programmatically encode categorical data for use with a machine learning prediction model such as a neural network classification or regression system.

  • Surface Duo Debut Presents Dual-Screen Dev Challenges

    Microsoft officially launched its new dual-screen Android device, Surface Duo, presenting new challenges -- and opportunities -- for developers to leverage the new form factor.

  • What's New in Blazor Tooling Updates

    Here's a quick look at what four major third-party Blazor tooling vendors have offered lately for Microsoft's red-hot project that allows for web development with C# instead of JavaScript.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events