Friday, September 24, 2010
Hi everyone - We’ve updated Microsoft Security Advisory2416728 to include a step in the workaround requiring the blocking of requests that specify the application error path on the querystring. This can be done using URLScan, a free tool for Internet Information Services (IIS) that can selectively block requests based on rules defined by the administrator.
Monday, September 20, 2010
Over the past couple of days we’ve received some additional questions regarding the ASP.NET vulnerability. In this post we will answer some of the most common ones. Is My ASP.NET Site Affected By This Issue? Yes, all sites that use ASP.NET are affected by this vulnerability. You should follow the recommendations outlined in the advisory.
Monday, September 20, 2010
Hi everyone - We’ve just updated Microsoft Security Advisory 2416728 as we’ve begun to see limited attacks with the ASP.NET vulnerability. We have added questions and answers and encourage customers to review this information and evaluate it for their environment. We have also added additional technical questions and answers to the Security and Defense blog, which has previously discussed the issue.
Friday, September 17, 2010
Hello, Today we published the Questions & Answers from the September 2010 Security Bulleting webcast. During the webcast, we answered 10 questions concerning the September bulletins, including inquiries about bulletin, MS10-061, involving the Stuxnet vulnerability. We also were asked about the Enhanced Mitigation Experience Toolkit 2.0 (EMET) as well as questions regarding the bulletin MS10-065 affecting IIS and its FastCGI vulnerability.
Friday, September 17, 2010
Hi everyone, Today we released Security Advisory 2416728 describing a publicly disclosed vulnerability in ASP.NET that affects all versions of the .NET Framework. At this time we are not aware of any attacks using this vulnerability and we encourage customers to review the advisory for mitigations and workarounds. Our Security Research & Defense team has written a blog post to explain how the workarounds work and have provided a script to help administrators determine if they have ASP.
Friday, September 17, 2010
Our recent advisory describes an ASP.NET vulnerability which was recently publicly disclosed. This blog post will give you more information about the vulnerability and the workaround. It will also provide a script which will help you detect ASP.NET applications on your server that are in a vulnerable configuration. The Impact of the Vulnerability
Thursday, September 16, 2010
Handle: Cluster IRL: Maarten Van Horenbeeck Rank: Senior Program Manager Likes: Slicing covert channels, foraging in remote memory pools, and setting off page faults Dislikes: The crackling sound of crypto breaking, warm vodka martni Microsoft often has the pleasure of welcoming foreign government officials to our headquarters. MSR
Tuesday, September 14, 2010
Today we released nine security bulletins. Four have a maximum severity rating of Critical with the other five having a maximum severity rating of Important. Furthermore, six of the nine bulletins either do not affect the latest version of our products or affect them with reduced severity. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment.
Tuesday, September 14, 2010
This morning we released security bulletin MS10-061 to address an issue in the Windows print spooler. In this blog post, we’d like to provide additional detail about the specific configurations of Windows that are vulnerable to this issue and more background on its connection to the Stuxnet malware. Vulnerable configurations
Tuesday, September 14, 2010
This month, Microsoft released an update for IIS that addresses three vulnerabilities. The blog post focuses on one of these: the Request Header Buffer Overflow Vulnerability (CVE-2010-2730), which affects IIS version 7.5 and has a maximum security impact of Remote Code Execution (RCE). Below we provide more details on the vulnerability and the potential for reliable remote code execution, to assist with assessing risk and prioritizing deployment of the update.
