14 DAY TRIAL // Early adopter testing the first upgrade for Windows 7 and Windows Server 2008 R2 should deploy a security update designed to patch the ASP.NET vulnerability disclosed the previous month just as the rest of Windows users. The Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 SP1 Beta and Windows Server 2008 R2 SP1 Beta is available for download through the Microsoft Download Center, along with the patch for .NET Framework 4.
At the end of September 2010, the software giant released Security Bulletin MS10-070 out of band, plugging a publicly disclosed security hole in ASP.NET which affects all versions of .NET released after 3.5 SP1.
Normally, Microsoft only patches Critical vulnerabilities in its software that is still in development.
However, it appears that in this particular situation, the Redmond company made an exception and also offered the update for Windows 7 SP1, although the upgrade is in Beta at this point in time.
“The vulnerability could allow information disclosure. An attacker who successfully exploited this vulnerability could read data, such as the view state, which was encrypted by the server,” Microsoft stated.
“This vulnerability can also be used for data tampering, which, if successfully exploited, could be used to decrypt and tamper with the data encrypted by the server. Microsoft .NET Framework versions prior to Microsoft .NET Framework 3.5 Service Pack 1 are not affected by the file content disclosure portion of this vulnerability.”
According to the software giant, the vulnerability in ASP.NET exists because of the improper way in which errors are being dealt with during encryption padding verification.
As far as .NET Framework 3.5 SP1 and above are concerned, the vulnerability can potentially allow attackers to grab the contents of any file within an ASP.NET application. Microsoft explained that this includes the web.config file.
Windows 7 Service Pack (SP1) Beta Build 7601.16562.100603-1800 is available for download here.