Featured Articles

IHS teardown reveals Galaxy S5 BOM

IHS teardown reveals Galaxy S5 BOM

Research firm IHS got hold of Samsung’s new flagship smartphone and took it apart to the last bolt to figure out…

More...
Galaxy S5, HTC One M8 available selling well

Galaxy S5, HTC One M8 available selling well

Samsung’s Galaxy S5 has finally gone on sale and it can be yours for €699, which is quite a lot of…

More...
Intel lists Haswell refresh parts

Intel lists Haswell refresh parts

Intel has added a load of Haswell refresh parts to its official price list and there really aren’t any surprises to…

More...
Respawn confirms Titanfall DLC for May

Respawn confirms Titanfall DLC for May

During his appearance at PAX East panel and confirmed on Twitter, Titanfall developer Respawn confirmed that the first DLC pack for…

More...
KFA2 GTX 780 Ti Hall Of Fame reviewed

KFA2 GTX 780 Ti Hall Of Fame reviewed

KFA2 gained a lot of overclocking experience with the GTX 780 Hall of Fame (HOF), which we had a chance to…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Friday, 30 December 2011 23:28

Microsoft releases off-schedule critical Windows Updates

Written by Jon Worrel

windows update_logo

Credible and urgent Windows threats

In an effort to seal some last-minute Windows exploits as 2011 comes to an end, Microsoft has recently pushed out a last-minute patch to address three privately reported vulnerabilities in Microsoft .NET Framework.

The software giant lasted a total of 363 days without releasing an update outside of the monthly Patch Tuesday cycle. Nevertheless, researchers recently discovered that a flaw exists in a wide variety of Web application platforms, including Python, PHP, ASP.NET and others. According to the security bulletin:

“An attacker who successfully exploited this vulnerability could take any action in the context of an existing account on the ASP.NET site, including executing arbitrary commands. In order to exploit this vulnerability, an attacker must be able to register an account on the ASP.NET site, and must know an existing user name.”

The update is rated Critical for Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5. Service Pack 1, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Windows, including Windows 7.

Nevertheless, Microsoft considers the threat to be credible and urgent enough that it released an out-of-band patch to address it and strongly recommends its users to run Windows Update as soon as possible. While the software giant hoped for a clean security bulletin record to finish off the year, Wolfgang Kandek, CTO of Qualys, notes that Microsoft developed and released this patch with lightning speed. “I'm sure a few people on Microsoft's security team are packing up the champagne that was ready for that end of year victory toast,” Andrew Storm of nCircle empathizes.

Last modified on Friday, 30 December 2011 23:36

Jon Worrel

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

Comments  

 
+2 #1 Bl0bb3r 2011-12-31 04:20
There's nothing wrong with releasing updates as soon as possible instead of announcing patch Tuesday and seeing how everybody jump the update button, slowing down the service.
 

To be able to post comments please log-in with Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments