ASP.NET vulnerability needs immediate attention
“Out-of-band” security notifications from Microsoft, security risks so serious they can’t wait for the next regularly schedule “Patch Tuesday,” have been described as rare, but this is, by my count, the third one this year after one in March and another in August. Do they still deserve to be called rare?
The Advanced Notification issued today is for a Security Bulletin to be issued Tuesday, Sept. 28; a Web cast is scheduled for 1:00 p.m. PDT at which details of the problem and the patch will be shared.
Microsoft’s Scott Guthrie has been blogging about the vulnerability for the past week and has publicized a workaround. The vulnerability exists in all versions of ASP.Net, Microsoft’s Web application development framework.
Microsoft, in Security Advisory 2416728, explains the nature of the vulnerability: “An attacker who exploited this vulnerability could view data, such as the View State, which was encrypted by the target server, or read data from files on the target server, such as web.config. This would allow the attacker to tamper with the contents of the data. By sending back the altered contents to an affected server, the attacker could observe the error codes returned by the server.”
Guthrie explained that the workaround involves enabling the “custom errors” feature of ASP.Net and configuring the feature to always display the same error notice, regardless of what the specific error may be. “By mapping all error pages to a single error page, you prevent a hacker from distinguishing between the different types of errors that occur on a server,” he wrote.
Microsoft is aware of only “limited, active attacks” based on the vulnerability, it stated Sept. 24.
Microsoft isn’t the only company doing frequent “rare” fixes. Adobe has had recurring emergency patches, too, prompting vulnerability researcher Charlie Miller to tweet, “Dear Adobe, when you patch out of band every month, you don’t have a patch cycle.”
Microsoft issues out-of-band security bulletins when it feels that the vulnerability is more serious than normal and that to wait until the normal Patch Tuesday roundup would be too risky. Perhaps because the bad guys are constantly working on new ways to hack into computers, even to the point of issuing release notes with new malicious code, rare out-of-band releases will become the new normal.
