News

Sept. Patch Tuesday Includes .NET Fixes

Two issues related to the .NET Framework and ASP.NET are included in Microsoft's monthly security bulletin release.

Like Microsoft OS software, its programming tools are no different and are often just as vulnerable. The company's latest security bulletin has two .NET-related nuggets that shouldn't be ignored, both rated as "Important."

The first one, MS14-053, involves a .NET Framework flaw that can be exploited only if ASP.NET is installed in tandem with it on a Windows system. With this combination, hackers can send a Denial of Service attack to .NET-enabled Web sites on those systems. The flaw affects .NET Framework versions 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 on various Windows versions (see full matrix here).

A fix for this flaw is downloaded and applied automatically for those using automatic updates; customers who prefer manual updating to test and apply the updates as soon as possible -- Microsoft's bulletin states that the flaw was privately reported, so there isn't any report so far of this flaw being exploited in the wild.

The second issue, which is a re-release of a bulletin from May, relates to an elevation of privilege attack that can be exploited with ASP.NET. Specifically, hackers would be able to take control of a system in ASP.NET viewstate where MAC code validation is disabled upon configuration (MAC code validation is enabled by default, so those who don't have this disabled are not affected; even so, it behooves developers and admins to be sure and check whether it's on or off).

Microsoft states that the bulletin was re-released so that customers using Microsoft Update are able to get the update automatically.

The flaw affects the same version of the .NET Framework noted in the first bulletin, except for versions 3.0 SP2 and 4.5.2.

A more comprehensive report on all the fixes and updates to the September security bulletin is on Redmondmag.com.

About the Author

You Tell 'Em, Readers: If you've read this far, know that Michael Domingo, Visual Studio Magazine Editor in Chief, is here to serve you, dear readers, and wants to get you the information you so richly deserve. What news, content, topics, issues do you want to see covered in Visual Studio Magazine? He's listening at [email protected].

comments powered by Disqus

Featured

  • VS Code Now Has Apple Silicon Builds for Native Mac Development

    Goodbye Rosetta, hello M1. Visual Studio Code has been updated with new builds that let it run natively on machines with Apple Silicon (M1), the company's own ARM64 chips.

  • Visual Studio 2019 for Mac v8.9 Ships with .NET 6 Preview 1 Support

    During its Ignite 2021 online event for IT pros and developers this week, Microsoft shipped Visual Studio 2019 for Mac v8.9, arriving with out-of-the-box support for .NET 6 Preview 1, which the company also released recently.

  • Analyst: TypeScript Now Firmly in Top 10 Echelon (Ruby, Not So Much)

    RedMonk analyst Stephen O'Grady believes TypeScript has achieved the rare feat of firmly ensconcing itself into the top 10 echelon of his ranking, now questioning how high it might go.

  • Black White Wave IMage

    Neural Regression Using PyTorch: Training

    The goal of a regression problem is to predict a single numeric value, for example, predicting the annual revenue of a new restaurant based on variables such as menu prices, number of tables, location and so on.

Upcoming Events