Hi All, Please note the following advisory on an important ASP.NET update to mitigate a high impact vulnerability; this affects all versions of ASP.NET.
See more on the advisory here - http://www.microsoft.com/technet/security/advisory/2416728.mspx Feed: ScottGu's Blog Posted on: Wednesday, 29 September 2010 5:59 AM Author: ScottGu Subject: ASP.NET Security Update Now Available This morning Microsoft released a security update<http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx> that addresses the ASP.NET Security Vulnerability<http://weblogs.asp.net/scottgu/archive/2010/09/24/update-on-asp-net-vulnerability.aspx> that I've blogged about this past week. We recommend installing it as soon as possible on your web-servers. Common Questions/Answers Below are some answers to a few common questions people have asked: Do the updates require me to change any code? No. The update should not require any code or configuration change to your existing ASP.NET applications. Will I still need to use the workarounds after I install the update? No. The update removes the need to use the security workarounds we've published this past week. Those were temporary steps that could be taken to protect yourself before the update was released. After you've installed the update you no longer need to use them. What is the impact of applying the update to a live web-server? If you apply the update to a live web-server, there will be some period of time when the web-server will be offline (although an OS reboot should not be required). You'll want to schedule and coordinate your updates appropriately. Importantly - if your site or application is running across multiple web-servers in a web-farm, you'll want to make sure the update is applied to all of the machines (and not just some of them). This is because the update changes the encryption/signing behavior of certain features in ASP.NET, and a mix of patched and un-patched servers will cause that encryption/signing behavior to be incompatible between them. If you are using a web-farm topology, you might want to look at pulling half of the machines out of rotation, update them, and then swap the active and inactive machines (so that the updated machines are in rotation, and the non-updated ones are pulled from rotation and patched next) to avoid these mismatches. Does this update work with SharePoint? Yes. We have not found any issues in testing SharePoint with this security update. You should install it on SharePoint servers to ensure that they are not vulnerable. Can I both install and uninstall the update? Yes. The updates support install and uninstall scenarios. Note that if you uninstall the update, though, it will leave your system unprotected. Downloading the Updates We are releasing the security update today via the Microsoft Download Center. We will also release the update via Windows Update and the Windows Server Update Service in a few days as we complete final distribution testing via these channels. Once the update is on Windows Update, you can simply run Windows Update on your computer/server and Windows Update will automatically choose the right update to download/apply based on what you have installed. If you download the updates directly from the Microsoft Download Center, then you need to manually select and download the appropriate updates. Below is a table of all of the different update packages available via the Microsoft Download Center today. The downloads are split up by Windows Operating System (and corresponding service pack and processor architecture). Each operating system version bucket below includes a listing of all available versions of .NET that are supported on it, and includes KB and download links to the appropriate security updates. Find your operating system within the below chart, then check to see which versions of .NET you have installed on it (details on how to determine which version of the .NET Framework is installed can be found here<http://msdn.microsoft.com/en-us/library/y549e41e.aspx>). Download and apply the update packages for each version of .NET that you are using on that server. Windows Server 2008 R2 and Windows 7 .NET Framework Version KB Article Patch .NET Framework 3.5.1 (Default install) KB2416471<http://support.microsoft.com/kb/2416471> Download<http://go.microsoft.com/fwlink/?LinkId=202405> .NET Framework 4 KB2416472<http://support.microsoft.com/kb/2416472> Download<http://go.microsoft.com/fwlink/?LinkId=202406> Windows Server 2008 SP2, Windows Vista SP2 .NET Framework Version KB Article Patch .NET Framework 2.0 SP2 (default install) KB2416470<http://support.microsoft.com/kb/2416470> Download<http://go.microsoft.com/fwlink/?LinkId=202404> .NET Framework 4 KB2416472<http://support.microsoft.com/kb/2416472> Download<http://go.microsoft.com/fwlink/?LinkId=202406> .NET Framework 3.5 SP1 KB2416470<http://support.microsoft.com/kb/2416470>, KB2416473<http://support.microsoft.com/kb/2416473> Download<http://go.microsoft.com/fwlink/?LinkId=202404>, Download<http://go.microsoft.com/fwlink/?LinkId=202423>* .NET Framework 3.5 KB2416470<http://support.microsoft.com/kb/2416470>, KB2418240<http://support.microsoft.com/kb/2418240> Download<http://go.microsoft.com/fwlink/?LinkId=202404>, Download<http://go.microsoft.com/fwlink/?LinkId=202422>* .NET Framework 1.1 SP1 KB2416447<http://support.microsoft.com/kb/2416447> Download<http://go.microsoft.com/fwlink/?LinkId=202397> *When multiple patch downloads are listed above against a .NET version (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches should be installed (order is not relevant). Windows Server 2008, Windows Vista SP1 .NET Framework Version KB Article Patch .NET Framework 2.0 SP1 (default install) KB2416469<http://support.microsoft.com/kb/2416469> Download<http://go.microsoft.com/fwlink/?LinkId=202401> .NET Framework 4 KB2416472<http://support.microsoft.com/kb/2416472> Download<http://go.microsoft.com/fwlink/?LinkId=202406> .NET Framework 3.5 SP1 KB2416474<http://support.microsoft.com/kb/2416474>, KB2416473<http://support.microsoft.com/kb/2416473> Download<http://go.microsoft.com/fwlink/?LinkId=202403>, Download<http://go.microsoft.com/fwlink/?LinkId=202423>* .NET Framework 2.0 SP2 KB2416474<http://support.microsoft.com/kb/2416474> Download<http://go.microsoft.com/fwlink/?LinkId=202403> .NET Framework 3.5 KB2416469<http://support.microsoft.com/kb/2416469>, KB2418240<http://support.microsoft.com/kb/2418240> Download<http://go.microsoft.com/fwlink/?LinkId=202401>, Download<http://go.microsoft.com/fwlink/?LinkId=202422>* .NET Framework 1.1 SP1 KB2416447<http://support.microsoft.com/kb/2416447> Download<http://go.microsoft.com/fwlink/?LinkId=202397> *When multiple patch downloads are listed above against a .NET version (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches should be installed (order is not relevant). Windows Server 2003 SP2 32-bit .NET Framework Version KB Article Patch .NET Framework 1.1 SP1 (default install) KB2416451<http://support.microsoft.com/kb/2416451> Download<http://go.microsoft.com/fwlink/?LinkId=202398> .NET Framework 4 KB2416472<http://support.microsoft.com/kb/2416472> Download<http://go.microsoft.com/fwlink/?LinkId=202406> .NET Framework 3.5 SP1 KB2418241<http://support.microsoft.com/kb/2418241>, KB2416473<http://support.microsoft.com/kb/2416473> Download<http://go.microsoft.com/fwlink/?LinkId=202402>, Download<http://go.microsoft.com/fwlink/?LinkId=202423>* .NET Framework 2.0 SP2 KB2418241<http://support.microsoft.com/kb/2418241> Download<http://go.microsoft.com/fwlink/?LinkId=202402> .NET Framework 3.5 KB2416468<http://support.microsoft.com/kb/2416468>, KB2418240<http://support.microsoft.com/kb/2418240> Download<http://go.microsoft.com/fwlink/?LinkId=202400>, Download<http://go.microsoft.com/fwlink/?LinkId=202422>* *When multiple patch downloads are listed above against a .NET version (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches should be installed (order is not relevant). Windows Server 2003 64-bit .NET Framework Version/SP KB Article Patch Default OS Configuration NA NA .NET Framework 4 KB2416472<http://support.microsoft.com/kb/2416472> Download<http://go.microsoft.com/fwlink/?LinkId=202406> .NET Framework 3.5 SP1 KB2418241<http://support.microsoft.com/kb/2418241>, KB2416473<http://support.microsoft.com/kb/2416473> Download<http://go.microsoft.com/fwlink/?LinkId=202402>, Download<http://go.microsoft.com/fwlink/?LinkId=202423>* .NET Framework 2.0 SP2 KB2418241<http://support.microsoft.com/kb/2418241> Download<http://go.microsoft.com/fwlink/?LinkId=202402> .NET Framework 3.5 KB2416468<http://support.microsoft.com/kb/2416468>, KB2418240<http://support.microsoft.com/kb/2418240> Download<http://go.microsoft.com/fwlink/?LinkId=202400>, Download<http://go.microsoft.com/fwlink/?LinkId=202422>* .NET Framework 1.1 SP1 KB2416447<http://support.microsoft.com/kb/2416447> Download<http://go.microsoft.com/fwlink/?LinkId=202397> *When multiple patch downloads are listed above against a .NET version (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches should be installed (order is not relevant). Windows XP SP3 32-bit and 64-bit .NET Framework Version/SP KB Article Patch Default OS Configuration NA NA .NET Framework 4 KB2416472<http://support.microsoft.com/kb/2416472> Download<http://go.microsoft.com/fwlink/?LinkId=202406> .NET Framework 3.5 SP1 KB2418241<http://support.microsoft.com/kb/2418241>, KB2416473<http://support.microsoft.com/kb/2416473> Download<http://go.microsoft.com/fwlink/?LinkId=202402>, Download<http://go.microsoft.com/fwlink/?LinkId=202423>* .NET Framework 2.0 SP2 KB2418241<http://support.microsoft.com/kb/2418241> Download<http://go.microsoft.com/fwlink/?LinkId=202402> .NET Framework 3.5 KB2416468<http://support.microsoft.com/kb/2416468>, KB2418240<http://support.microsoft.com/kb/2418240> Download<http://go.microsoft.com/fwlink/?LinkId=202400>, Download<http://go.microsoft.com/fwlink/?LinkId=202422>* .NET Framework 1.1 SP1 KB2416447<http://support.microsoft.com/kb/2416447> Download<http://go.microsoft.com/fwlink/?LinkId=202397> *When multiple patch downloads are listed above against a .NET version (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches should be installed (order is not relevant). Summary We recommend immediately applying the security update to your servers in order to protect your applications against attackers trying to exploit them. We'd like to thank Juliano Rizzo and Thai Duong, who discovered that their previous research worked against ASP.NET, for not releasing their POET tool publicly before our update was ready. You can ask questions and get help with the security vulnerability and update in a special ASP.NET Forum<http://forums.asp.net/1233.aspx> that we have setup here<http://forums.asp.net/1233.aspx>. If you have problems or questions you can also contact Microsoft Customer Support<http://support.microsoft.com/contactus/?ws=support> for help (including support over the phone with a support engineer). The official Microsoft Security Bulletin post is here<http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx>. Thanks, Scott [http://weblogs.asp.net/aggbug.aspx?PostID=7621397] View article...<http://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-security-update-now-available.aspx> Thanks Jorke Jorke Odolphi<http://blogs.technet.com/jorke> | Infrastructure Evangelist | http://blogs.technet.com/jorke Microsoft Australia<http://www.microsoft.com/australia> | e: [email protected]<mailto:[email protected]> | im: [email protected]<im:[email protected]>| twitter.com/jorke +61 2 8817 9126 | +61 488717714
