No, it's nothing to do with Oracle database - in fact it is independent of whether you would be using a database connection of any sort.
(I'm ignorant of these security things, but I followed the links that Silky gave and educated myself) ________________________________ Ian Thomas Victoria Park, Western Australia -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of [email protected] Sent: Wednesday, September 29, 2010 8:36 AM To: ozDotNet Subject: Re: IMPORTANT - ASP.NET update and security advisory Question - does this just affect people using Oracle, or does it affect all .net instances? T. On Wed, Sep 29th, 2010 at 9:25 AM, Jorke Odolphi <[email protected]> wrote: > Hi All, > > Please note the following advisory on an important ASP.NET update to > mitigate a high impact vulnerability; this affects all versions of > ASP.NET. > > See more on the advisory here - > http://www.microsoft.com/technet/security/advisory/2416728.mspx > > > > Feed: ScottGu's Blog > Posted on: Wednesday, 29 September 2010 5:59 AM > Author: ScottGu > Subject: ASP.NET Security Update Now Available > > > This morning Microsoft released a security > update<http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx> > that addresses the ASP.NET Security > Vulnerability<http://weblogs.asp.net/scottgu/archive/2010/09/24/update-on-as p-net- vulnerability.aspx> > that I've blogged about this past week. We recommend installing it as > soon as possible on your web-servers. > > Common Questions/Answers > > Below are some answers to a few common questions people have asked: > Do the updates require me to change any code? > No. The update should not require any code or configuration change to your > existing ASP.NET applications. > Will I still need to use the workarounds after I install the update? > No. The update removes the need to use the security workarounds we've > published this past week. Those were temporary steps that could be taken > to protect yourself before the update was released. After you've > installed the update you no longer need to use them. > What is the impact of applying the update to a live web-server? > If you apply the update to a live web-server, there will be some period of > time when the web-server will be offline (although an OS reboot should not > be required). You'll want to schedule and coordinate your updates > appropriately. > Importantly - if your site or application is running across multiple > web-servers in a web-farm, you'll want to make sure the update is applied > to all of the machines (and not just some of them). This is because the > update changes the encryption/signing behavior of certain features in > ASP.NET, and a mix of patched and un-patched servers will cause that > encryption/signing behavior to be incompatible between them. If you are > using a web-farm topology, you might want to look at pulling half of the > machines out of rotation, update them, and then swap the active and > inactive machines (so that the updated machines are in rotation, and the > non-updated ones are pulled from rotation and patched next) to avoid these > mismatches. > Does this update work with SharePoint? > Yes. We have not found any issues in testing SharePoint with this > security update. You should install it on SharePoint servers to ensure > that they are not vulnerable. > Can I both install and uninstall the update? > Yes. The updates support install and uninstall scenarios. Note that if > you uninstall the update, though, it will leave your system unprotected. > > Downloading the Updates > > We are releasing the security update today via the Microsoft Download > Center. We will also release the update via Windows Update and the > Windows Server Update Service in a few days as we complete final > distribution testing via these channels. Once the update is on Windows > Update, you can simply run Windows Update on your computer/server and > Windows Update will automatically choose the right update to > download/apply based on what you have installed. > If you download the updates directly from the Microsoft Download Center, > then you need to manually select and download the appropriate updates. > Below is a table of all of the different update packages available via the > Microsoft Download Center today. The downloads are split up by Windows > Operating System (and corresponding service pack and processor > architecture). Each operating system version bucket below includes a > listing of all available versions of .NET that are supported on it, and > includes KB and download links to the appropriate security updates. > Find your operating system within the below chart, then check to see which > versions of .NET you have installed on it (details on how to determine > which version of the .NET Framework is installed can be found > here<http://msdn.microsoft.com/en-us/library/y549e41e.aspx>). Download > and apply the update packages for each version of .NET that you are using > on that server. > > Windows Server 2008 R2 and Windows 7 > > > > .NET Framework Version > KB Article > Patch > > > .NET Framework 3.5.1 (Default install) > KB2416471<http://support.microsoft.com/kb/2416471> > Download<http://go.microsoft.com/fwlink/?LinkId=202405> > > > .NET Framework 4 > KB2416472<http://support.microsoft.com/kb/2416472> > Download<http://go.microsoft.com/fwlink/?LinkId=202406> > > > Windows Server 2008 SP2, Windows Vista SP2 > > > > .NET Framework Version > KB Article > Patch > > > .NET Framework 2.0 SP2 (default install) > KB2416470<http://support.microsoft.com/kb/2416470> > Download<http://go.microsoft.com/fwlink/?LinkId=202404> > > > .NET Framework 4 > KB2416472<http://support.microsoft.com/kb/2416472> > Download<http://go.microsoft.com/fwlink/?LinkId=202406> > > > .NET Framework 3.5 SP1 > KB2416470<http://support.microsoft.com/kb/2416470>, > KB2416473<http://support.microsoft.com/kb/2416473> > Download<http://go.microsoft.com/fwlink/?LinkId=202404>, > Download<http://go.microsoft.com/fwlink/?LinkId=202423>* > > > .NET Framework 3.5 > KB2416470<http://support.microsoft.com/kb/2416470>, > KB2418240<http://support.microsoft.com/kb/2418240> > Download<http://go.microsoft.com/fwlink/?LinkId=202404>, > Download<http://go.microsoft.com/fwlink/?LinkId=202422>* > > > .NET Framework 1.1 SP1 > KB2416447<http://support.microsoft.com/kb/2416447> > Download<http://go.microsoft.com/fwlink/?LinkId=202397> > > > *When multiple patch downloads are listed above against a .NET version > (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches > should be installed (order is not relevant). > > Windows Server 2008, Windows Vista SP1 > > > > .NET Framework Version > KB Article > Patch > > > .NET Framework 2.0 SP1 (default install) > KB2416469<http://support.microsoft.com/kb/2416469> > Download<http://go.microsoft.com/fwlink/?LinkId=202401> > > > .NET Framework 4 > KB2416472<http://support.microsoft.com/kb/2416472> > Download<http://go.microsoft.com/fwlink/?LinkId=202406> > > > .NET Framework 3.5 SP1 > KB2416474<http://support.microsoft.com/kb/2416474>, > KB2416473<http://support.microsoft.com/kb/2416473> > Download<http://go.microsoft.com/fwlink/?LinkId=202403>, > Download<http://go.microsoft.com/fwlink/?LinkId=202423>* > > > .NET Framework 2.0 SP2 > KB2416474<http://support.microsoft.com/kb/2416474> > Download<http://go.microsoft.com/fwlink/?LinkId=202403> > > > .NET Framework 3.5 > KB2416469<http://support.microsoft.com/kb/2416469>, > KB2418240<http://support.microsoft.com/kb/2418240> > Download<http://go.microsoft.com/fwlink/?LinkId=202401>, > Download<http://go.microsoft.com/fwlink/?LinkId=202422>* > > > .NET Framework 1.1 SP1 > KB2416447<http://support.microsoft.com/kb/2416447> > Download<http://go.microsoft.com/fwlink/?LinkId=202397> > > > *When multiple patch downloads are listed above against a .NET version > (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches > should be installed (order is not relevant). > > Windows Server 2003 SP2 32-bit > > > > .NET Framework Version > KB Article > Patch > > > .NET Framework 1.1 SP1 (default install) > KB2416451<http://support.microsoft.com/kb/2416451> > Download<http://go.microsoft.com/fwlink/?LinkId=202398> > > > .NET Framework 4 > KB2416472<http://support.microsoft.com/kb/2416472> > Download<http://go.microsoft.com/fwlink/?LinkId=202406> > > > .NET Framework 3.5 SP1 > KB2418241<http://support.microsoft.com/kb/2418241>, > KB2416473<http://support.microsoft.com/kb/2416473> > Download<http://go.microsoft.com/fwlink/?LinkId=202402>, > Download<http://go.microsoft.com/fwlink/?LinkId=202423>* > > > .NET Framework 2.0 SP2 > KB2418241<http://support.microsoft.com/kb/2418241> > Download<http://go.microsoft.com/fwlink/?LinkId=202402> > > > .NET Framework 3.5 > KB2416468<http://support.microsoft.com/kb/2416468>, > KB2418240<http://support.microsoft.com/kb/2418240> > Download<http://go.microsoft.com/fwlink/?LinkId=202400>, > Download<http://go.microsoft.com/fwlink/?LinkId=202422>* > > > *When multiple patch downloads are listed above against a .NET version > (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches > should be installed (order is not relevant). > > Windows Server 2003 64-bit > > > > .NET Framework Version/SP > KB Article > Patch > > > Default OS Configuration > NA > NA > > > .NET Framework 4 > KB2416472<http://support.microsoft.com/kb/2416472> > Download<http://go.microsoft.com/fwlink/?LinkId=202406> > > > .NET Framework 3.5 SP1 > KB2418241<http://support.microsoft.com/kb/2418241>, > KB2416473<http://support.microsoft.com/kb/2416473> > Download<http://go.microsoft.com/fwlink/?LinkId=202402>, > Download<http://go.microsoft.com/fwlink/?LinkId=202423>* > > > .NET Framework 2.0 SP2 > KB2418241<http://support.microsoft.com/kb/2418241> > Download<http://go.microsoft.com/fwlink/?LinkId=202402> > > > .NET Framework 3.5 > KB2416468<http://support.microsoft.com/kb/2416468>, > KB2418240<http://support.microsoft.com/kb/2418240> > Download<http://go.microsoft.com/fwlink/?LinkId=202400>, > Download<http://go.microsoft.com/fwlink/?LinkId=202422>* > > > .NET Framework 1.1 SP1 > KB2416447<http://support.microsoft.com/kb/2416447> > Download<http://go.microsoft.com/fwlink/?LinkId=202397> > > > *When multiple patch downloads are listed above against a .NET version > (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches > should be installed (order is not relevant). > > Windows XP SP3 32-bit and 64-bit > > > > .NET Framework Version/SP > KB Article > Patch > > > Default OS Configuration > NA > NA > > > .NET Framework 4 > KB2416472<http://support.microsoft.com/kb/2416472> > Download<http://go.microsoft.com/fwlink/?LinkId=202406> > > > .NET Framework 3.5 SP1 > KB2418241<http://support.microsoft.com/kb/2418241>, > KB2416473<http://support.microsoft.com/kb/2416473> > Download<http://go.microsoft.com/fwlink/?LinkId=202402>, > Download<http://go.microsoft.com/fwlink/?LinkId=202423>* > > > .NET Framework 2.0 SP2 > KB2418241<http://support.microsoft.com/kb/2418241> > Download<http://go.microsoft.com/fwlink/?LinkId=202402> > > > .NET Framework 3.5 > KB2416468<http://support.microsoft.com/kb/2416468>, > KB2418240<http://support.microsoft.com/kb/2418240> > Download<http://go.microsoft.com/fwlink/?LinkId=202400>, > Download<http://go.microsoft.com/fwlink/?LinkId=202422>* > > > .NET Framework 1.1 SP1 > KB2416447<http://support.microsoft.com/kb/2416447> > Download<http://go.microsoft.com/fwlink/?LinkId=202397> > > > *When multiple patch downloads are listed above against a .NET version > (for example with .NET 3.5 SP1 and .NET 3.5 installs) then all patches > should be installed (order is not relevant). > > Summary > > We recommend immediately applying the security update to your servers in > order to protect your applications against attackers trying to exploit > them. We'd like to thank Juliano Rizzo and Thai Duong, who discovered > that their previous research worked against ASP.NET, for not releasing > their POET tool publicly before our update was ready. > You can ask questions and get help with the security vulnerability and > update in a special ASP.NET Forum<http://forums.asp.net/1233.aspx> that we > have setup here<http://forums.asp.net/1233.aspx>. If you have problems or > questions you can also contact Microsoft Customer > Support<http://support.microsoft.com/contactus/?ws=support> for help > (including support over the phone with a support engineer). The official > Microsoft Security Bulletin post is > here<http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx>. > Thanks, > Scott > [http://weblogs.asp.net/aggbug.aspx?PostID=7621397] > > View > article...<http://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-securit y-update-now- available.aspx> > > > > Thanks > Jorke > > Jorke Odolphi<http://blogs.technet.com/jorke> | Infrastructure Evangelist > | http://blogs.technet.com/jorke > Microsoft Australia<http://www.microsoft.com/australia> | e: > [email protected]<mailto:[email protected]> | im: > [email protected]<im:[email protected]>| twitter.com/jorke > +61 2 8817 9126 | +61 488717714 > > > >
