Sept. Patch Tuesday Includes .NET Fixes

Two issues related to the .NET Framework and ASP.NET are included in Microsoft's monthly security bulletin release.

Like Microsoft OS software, its programming tools are no different and are often just as vulnerable. The company's latest security bulletin has two .NET-related nuggets that shouldn't be ignored, both rated as "Important."

The first one, MS14-053, involves a .NET Framework flaw that can be exploited only if ASP.NET is installed in tandem with it on a Windows system. With this combination, hackers can send a Denial of Service attack to .NET-enabled Web sites on those systems. The flaw affects .NET Framework versions 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 on various Windows versions (see full matrix here).

A fix for this flaw is downloaded and applied automatically for those using automatic updates; customers who prefer manual updating to test and apply the updates as soon as possible -- Microsoft's bulletin states that the flaw was privately reported, so there isn't any report so far of this flaw being exploited in the wild.

The second issue, which is a re-release of a bulletin from May, relates to an elevation of privilege attack that can be exploited with ASP.NET. Specifically, hackers would be able to take control of a system in ASP.NET viewstate where MAC code validation is disabled upon configuration (MAC code validation is enabled by default, so those who don't have this disabled are not affected; even so, it behooves developers and admins to be sure and check whether it's on or off).

Microsoft states that the bulletin was re-released so that customers using Microsoft Update are able to get the update automatically.

The flaw affects the same version of the .NET Framework noted in the first bulletin, except for versions 3.0 SP2 and 4.5.2.

A more comprehensive report on all the fixes and updates to the September security bulletin is on

About the Author

You Tell 'Em, Readers: If you've read this far, know that Michael Domingo, Visual Studio Magazine Editor in Chief, is here to serve you, dear readers, and wants to get you the information you so richly deserve. What news, content, topics, issues do you want to see covered in Visual Studio Magazine? He's listening at [email protected].

comments powered by Disqus


  • What's Next for ASP.NET Core and Blazor

    Since its inception as an intriguing experiment in leveraging WebAssembly to enable dynamic web development with C#, Blazor has evolved into a mature, fully featured framework. Integral to the ASP.NET Core ecosystem, Blazor offers developers a unique combination of server-side rendering and rich client-side interactivity.

  • Nearest Centroid Classification for Numeric Data Using C#

    Here's a complete end-to-end demo of what Dr. James McCaffrey of Microsoft Research says is arguably the simplest possible classification technique.

  • .NET MAUI in VS Code Goes GA

    Visual Studio Code's .NET MAUI workload, which evolves the former Xamarin.Forms mobile-centric framework by adding support for creating desktop applications, has reached general availability.

  • Visual Studio Devs Quick to Sound Off on Automatic Updates: 'Please No'

    A five-year-old Visual Studio feature request for automatic IDE updates is finally getting enacted by Microsoft amid a lot of initial developer pushback, seemingly misplaced.

  • First Official OpenAI Library for .NET Goes Beta

    Although it seems Microsoft and OpenAI have been deeply intertwined partners for a long time, they are only now getting around to releasing an official OpenAI library for .NET developers, joining existing community libraries.

Subscribe on YouTube