Skip to main content
MSRC

Microsoft Security Response Center Blog

October 2010 Security Bulletin Release

Monday, October 11, 2010

Hello - Today, as part of our regular monthly security bulletin release process, we are releasing 16 comprehensive updates addressing 49 vulnerabilities affecting Windows, Internet Explorer (IE), Microsoft Office, and the .NET Framework. This release represents our commitment to provide predictable, high-quality updates as part of the service our customers get when they buy Microsoft products.

The Rapidly Evolving Exploitation Playground

Thursday, October 07, 2010

Hey there, Vincenzo and Fermin here! Next week we will be giving two talks at BlueHat. Vincenzo will be talking with Tim Kornau, Ralf Philipp Weinmann, and Thomas Dullien, about return-oriented programming and how to automate the creation of ROP payloads. Also, Fermin and Andrew Roths will be talking about EMET and how it can prevent the successful exploitation of vulnerabilities.

Microsoft Releases MS10-070 to all distribution channels

Thursday, September 30, 2010

Hi everyone - Today we released out-of-band Security Update MS10-070through the remainder of our standard distribution channels, including Windows Update and Windows Server Update Services. We have completed our testing of these channels and confirmed the update can be successfully downloaded. Customers are strongly encouraged to download the Security Update, test it in their environments and deploy it as quickly as possible.

Q&A from the September 2010 Out-of-Band Security Release webcast

Thursday, September 30, 2010

Hello, Below you will find the webcast we conducted earlier this week as part of the MS10-070 Security Update which was released Out-of-Band. We have also published the questions and answers from that webcast and linked them here. The response for this webcast was amazing; however, due to time constraints, we were unable to answer all of the questions that were asked during the live webcast.

MS10-070 Released Out-of-Band Today

Tuesday, September 28, 2010

Hello, As we announced yesterday, today we released Security Bulletin MS10-070 out-of-band to address a vulnerability in ASP.NET. The bulletin and the blog by Scott Guthrie, corporate vice president of Microsoft’s .NET Developer Platform are available for more information. This security update addresses a vulnerability affecting all versions of the .

Out of Band Release to Address Microsoft Security Advisory 2416728

Sunday, September 26, 2010

Hello - Today we provided advance notification to customers that we will release an out-of-band security update to address the vulnerability discussed in Security Advisory 2416728. The update is scheduled for release tomorrow, Tuesday, September 28, 2010 at approximately 10:00 AM PDT. The bulletin has a severity rating of Important and addresses a publicly disclosed vulnerability in ASP.

Security Advisory 2416728 - Workaround Update

Friday, September 24, 2010

Hi everyone - We’ve updated Microsoft Security Advisory2416728 to include a step in the workaround requiring the blocking of requests that specify the application error path on the querystring. This can be done using URLScan, a free tool for Internet Information Services (IIS) that can selectively block requests based on rules defined by the administrator.

Additional Information about the ASP.NET Vulnerability

Monday, September 20, 2010

Over the past couple of days we’ve received some additional questions regarding the ASP.NET vulnerability. In this post we will answer some of the most common ones. Is My ASP.NET Site Affected By This Issue? Yes, all sites that use ASP.NET are affected by this vulnerability. You should follow the recommendations outlined in the advisory.

Update to Security Advisory 2416728

Monday, September 20, 2010

Hi everyone - We’ve just updated Microsoft Security Advisory 2416728 as we’ve begun to see limited attacks with the ASP.NET vulnerability. We have added questions and answers and encourage customers to review this information and evaluate it for their environment. We have also added additional technical questions and answers to the Security and Defense blog, which has previously discussed the issue.