Tech Outpost

[Floating_Red]

Customers using ASP.NET in Public-Facing Servcies are advised to read Microsoft Security Advisory (2416728) and to apply the Workarounds immediately. Several Exploit Tools are available for this Class of Vulnerability and Microsoft reports that SharePoint and Exchange - and all applications that rely on ASP.NET - are affected by this Vulnerability. This issue is being exploited in-the-Wild in Limited Attacks and in some cases can result in a complete system compromise. Further information is available in the below resources. 

Microsoft Security Advisory (2416728):
Vulnerability in ASP.NET Could Allow Information Disclosure:
https://www.microsoft.com/technet/security/advisory/2416728.mspx.

Security Advisory 2416728 Released:
http://blogs.technet.com/b/msrc/archive/2010/09/17/security-advisory-2416728-released.aspx.

Understanding the ASP.NET Vulnerability:
http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx.

Important: ASP.NET Security Vulnerability:
http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx.

Frequently Asked Questions about the ASP.NET Security Vulnerability:
http://weblogs.asp.net/scottgu/archive/2010/09/20/frequently-asked-questions-about-the-asp-net-secur....

[edit: Fixed posting error.]     

[floplot Norton Fighter]

Hello All

Microsoft is planning to release an out of cycle update to fix this problem on Tues. Sept 28th.

Please see this article for further information. Thanks.

http://www.zdnet.com/blog/security/malware-attacks-force-ms-to-ship-emergency-aspnet-patch/7385?tag=...

[Floating_Red · Accepted solution]

Microsoft has released Security Advisory M.S.10-070 and Patches for this Issue. Customers are advised to re-view and Install the Patch as soon as possible. Workarounds are also available; however some Reports suggest that they do not protect against all Timing Attacks.  Please see Microsoft "Patch Tuesday" for Patch Details.