ASP.NET Core, .NET Core, EF Core 1.0.1 Updates -- Visual Studio Magazine

ASP.NET Core, .NET Core, EF Core 1.0.1 Updates

Among the list of bug fixes is one that squashes a potential security issue with ASP.NET Core View Component that can result in an elevation of privilege on systems.

By Michael Domingo
09/14/2016

Microsoft this week released updates to ASP.NET Core, .NET Core and Entity Framework Core that consisted mainly of a growing list of fixes. Among the fix rollup is one that plugs up a potential security breakdown within ASP.NET Core. Microsoft details the issue in a TechNet security bulletin that was released at the same time.

According to the bulletin, the issue affects "the public version of ASP.NET Core MVC 1.0.0 whereView Components could receive incorrect information, including details of the current authenticated user." The bulletin goes on to explain that "If a View Component depends on the vulnerable code and makes decisions based on the current user, then the View Component could make incorrect decisions that result in elevation of privilege."

For those affected, it's a matter of updating the ASP.NET Core templates to the most recent version, which can be found in the Tools section of the .NET Framework Downloads page.

Besides the security issue fix, many of the other fixes were customer discoveries, said Jeffrey T. Fritz, a senior program manager with Microsoft's Developer Outreach Group, in a blog. "Most of the bugs we are addressing were identified by customers and don't have easy workarounds." He said that developers using any of the ASP.NET Core 1.0.0 version of the packages listed here are advised to update to the 1.0.1 versions as soon as possible:

Microsoft.EntityFrameworkCore
Microsoft.AspNetCore.Server.Kestrel
Microsoft.AspNetCore.Mvc
Microsoft.AspNetCore.Antiforgery
Microsoft.AspNetCore.Routing

Fritz notes that the last two packages are referenced by the third package, Microsoft.AspNetCore.Mvc. "If you are not directly referencing them in your project, you do not need to do any extra work to update them," he explained. "The package manager will automatically include the updated versions when it updates the MVC package." He added that any references in the project.json file also needed to be updated with the newer version numbers.

Highlighted among the issues in .NET Core 1.0.0 that were fixed:

Segfaults on Linux 4.6
Access violation on Windows
F# template has been updated for .NET Core 1.0
Update ASP.NET Core templates to reference ASP.NET Core 1.0.1
Update ASP.NET Core templates to correctly publish CSHTML files

These are easily fixed by updating to .NET Core 1.0.1, available for download here.

About the Author

Michael Domingo is a long-time software publishing veteran, having started up and managed several developer publications for the Clipper compiler, Microsoft Access, and Visual Basic. He's also managed IT pubs for 1105 Media, including Microsoft Certified Professional Magazine and Virtualization Review before landing his current gig as Visual Studio Magazine Editor in Chief. Besides his publishing life, he's a professional photographer, whose work can be found by Googling domingophoto.

Printable Format

comments powered by Disqus

Featured

Copilot Engineering in the Cloud with Azure and GitHub

Who better to lead a full-day deep dive into this tech than two experts from GitHub, which introduced the original "AI pair programmer" and spawned the ubiquitous Copilot moniker?
Uno Platform Wants Microsoft to Improve .NET WebAssembly in Two Ways

Uno Platform, a third-party dev tooling specialist that caters to .NET developers, published a report on the state of WebAssembly, addressing some shortcomings in the .NET implementation it would like to see Microsoft address.
Random Neighborhoods Regression Using C#

Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the random neighborhoods regression technique, where the goal is to predict a single numeric value. Compared to other ML regression techniques, advantages are that it can handle both large and small datasets, and the results are highly interpretable.
As Some Orgs Restrict DeepSeek AI Usage, Microsoft Offers Models and Dev Guidance

While some organizations are restricting employee usage of the new open source DeepSeek AI from a Chinese company due to data collection concerns, Microsoft has taken a different approach.
Useful New-ish Features in .NET/C#

We often hear about the big new features in .NET or C#, but what about all of those lesser known, but useful new features? How exactly do you use constructs like collection indices and ranges, date features, and pattern matching?