The software giant lasted a total of 363 days without releasing an update outside of the monthly Patch Tuesday cycle. Nevertheless, researchers recently discovered that a flaw exists in a wide variety of Web application platforms, including Python, PHP, ASP.NET and others. According to the security bulletin:
“An attacker who successfully exploited this vulnerability could take any action in the context of an existing account on the ASP.NET site, including executing arbitrary commands. In order to exploit this vulnerability, an attacker must be able to register an account on the ASP.NET site, and must know an existing user name.”
The update is rated Critical for Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5. Service Pack 1, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Windows, including Windows 7.
Nevertheless, Microsoft considers the threat to be credible and urgent enough that it released an out-of-band patch to address it and strongly recommends its users to run Windows Update as soon as possible. While the software giant hoped for a clean security bulletin record to finish off the year, Wolfgang Kandek, CTO of Qualys, notes that Microsoft developed and released this patch with lightning speed. “I'm sure a few people on Microsoft's security team are packing up the champagne that was ready for that end of year victory toast,” Andrew Storm of nCircle empathizes.