Today, we are releasing the December 2018 Security and Quality Rollup. Security CVE-2018-8540 – Windows Remote Code Execution Vulnerability This security update resolves a vulnerability in Microsoft .NET Framework that could allow remote code execution when Microsoft .NET Framework doesn't validate input correctly. The attacker who successfully ...
Today, we are releasing the November 2018 Security and Quality Rollup.SecurityNo new security fixes. See .NET Framework September 2018 Security and Quality Rollup for the latest security updates.Quality and ReliabilityThis release contains the following quality and reliability improvements.CLRWFWinformsWPFNote: Additional information on these impro...
Today, we released the October 2018 Security and Quality Rollup. Security No new security fixes. See .NET Framework September 2018 Security and Quality Rollup for the latest security update. Quality and Reliability This release contains the following quality and reliability improvements. CLR WPF Note:...
During an appearance on the .NET Rocks podcast last week, a question was raised about securely sending information through ASP.NET ViewState. I responded to the question by indicating that the typical security concern for web content is not to trust any content submitted from the web, including ViewState. After that podcast was published, several...
This is a guest post by Brock Allen and Dominick Baier. They are security consultants, speakers, and the authors of many popular open source security projects, including IdentityServer. Modern applications need modern identity. The protocols used for implementing features like authentication, single sign-on, API access control and federation are O...
After learning about the new Authorization Policy model in ASP.NET Core, our intrepid reporter Seth Juarez wanted to learn about more complicated ASP.NET Authorization policies. In the following video, he speaks with ASP.NET Security Analyst Barry Dorrans. Last time, Barry showed us how to get started with the new ASP.NET Policy model. Notes and...
After learning about Authentication in ASP.NET Core, our intrepid reporter Seth Juarez wanted to dig deeper into the ASP.NET Authorization story. In the following video, he speaks with ASP.NET Security Analyst Barry Dorrans. Notes and links from their discussion follow. Authorization verifies that a user is permitted to access functi...
With the coming changes in ASP.NET Core, our friend and intrepid reporter Seth Juarez sat down with ASP.NET Program Manager Pranav Rastogi to discuss the updates and improvements in the new ASP.NET Core authentication system: Here are some of the highlights of their discussion and some sample code to get you started: Pranav gave a quick definition ...
The ASP.NET team is making an important announcement regarding the September 2014 security updates. All versions of the ASP.NET runtime 1.1 - 4.5.2 now forbid setting <%@ Page EnableViewStateMac="false" %> and <pages enableViewStateMac="false" />. If you have set EnableViewStateMac="false" anywhere in your application, your applica...
This article explains the recent changes made to Google OpenID and OAuth 2.0 along with the corresponding updates to the 3.0.0 RC release of Google OAuth middleware. Here we will first look at the experience of using Google OAuth middleware in an MVC application with the OWIN 2.1.0 release bits. We will then explain the current changes to Go...
