Microsoft published the following security bulletin updates:
- MS10-070 - Important: Vulnerability in ASP.NET Could Allow Information Disclosure (2418042) - Version:1.0
- Microsoft Security Advisory (2416728): Vulnerability in ASP.NET Could Allow Information Disclosure
- MS10-064 - Critical: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2315011) - Version:1.1
MS10-070 - Important: Vulnerability in ASP.NET Could Allow Information Disclosure (2418042) - Version:1.0
Microsoft Security Advisory (2416728): Vulnerability in ASP.NET Could Allow Information Disclosure
MS10-064 - Critical: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2315011) - Version:1.1
- MS10-070 - Important: Vulnerability in ASP.NET Could Allow Information Disclosure (2418042) - Version:1.0
- Microsoft Security Advisory (2416728): Vulnerability in ASP.NET Could Allow Information Disclosure
- MS10-064 - Critical: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2315011) - Version:1.1
MS10-070 - Important: Vulnerability in ASP.NET Could Allow Information Disclosure (2418042) - Version:1.0
Severity Rating: Important - Revision Note: V1.0 (September 28, 2010): Bulletin published.Read more
Summary: This security update resolves a publicly disclosed vulnerability in ASP.NET. The vulnerability could allow information disclosure. An attacker who successfully exploited this vulnerability could read data, such as the view state, which was encrypted by the server. This vulnerability can also be used for data tampering, which, if successfully exploited, could be used to decrypt and tamper with the data encrypted by the server. Microsoft .NET Framework versions prior to Microsoft .NET Framework 3.5 Service Pack 1 are not affected by the file content disclosure portion of this vulnerability.
Microsoft Security Advisory (2416728): Vulnerability in ASP.NET Could Allow Information Disclosure
Revision Note: V1.2 (September 24, 2010): Added an entry to the FAQ to announce a revision to the workaround, "Enable a UrlScan or Request Filtering rule, enable ASP.NET custom errors, and map all error codes to the same error page." Customers who have already applied the workaround should reapply all listed steps.Read more
Summary: Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS10-070 to address this issue. For more information about this issue, including download links for an available security update, please review MS10-070. The vulnerability addressed is the ASP.NET Padding Oracle Vulnerability - CVE-2010-3332.
MS10-064 - Critical: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2315011) - Version:1.1
Severity Rating: Critical - Revision Note: V1.1 (September 22, 2010): Removed erroneous references to Outlook Express 6 in the workaround for Heap Based Buffer Overflow in Outlook Vulnerability - CVE-2010-2728.Read more
Summary: This security update resolves a privately reported vulnerability. The vulnerability could allow remote code execution if a user opened or previewed a specially crafted e-mail message using an affected version of Microsoft Outlook that is connected to an Exchange server with Online Mode. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
