Sponsored by..

Tuesday 28 September 2010

MS10-070 - don't panic.. on second thoughts.. PANIC

Those of you who know Microsoft patch levels probably already treat "Important" patches with a shrug, because the really important ones are always "Critical". So when Microsoft does an out-of-band patch only rated as "Important" then there's something not right going on.

Well, MS10-070 is one such patch, and to be brutally brief it means that IIS servers are vulnerable to an information disclosure attack.. very bad news if you are running IIS.

The ISC have more here, but be sure to read the comments.. because this one is looking like a complete fragging disaster zone..

1 comment:

Yuhong Bao said...

Well, it only affects IIS servers running ASP.NET. Basically this patch fix a serious crypto usage flaw. Google for "ASP.NET padding oracle" for some more information.