A first hand look from the .NET engineering teams
As part of our continued effort to bring greater transparency for our customers we are going to start posting here whenever we ship any security fixes for the .NET Framework, this is the first such post.
The .NET team released a security bulletin earlier this week as part of the monthly “patch Tuesday” cycle.
Microsoft Security Bulletin MS14-009 - Important, Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607)
This security update resolves two publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft .NET Framework. The most severe vulnerability could allow elevation of privilege if a user visits a specially crafted website or a website containing specially crafted web content. In all cases, however, an attacker would have no way to force users to visit such websites. Instead, an attacker would have to convince users to visit the compromised website, typically by getting them to click a link in an email message or in an Instant Messenger message that takes them to the attacker's website.
This security update is rated Important for Microsoft .NET Framework 1.0 Service Pack 3, Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4, Microsoft .NET Framework 4.5, and Microsoft .NET Framework 4.5.1 on affected editions of Microsoft Windows.
More details about the versions affected by this vulnerability can be found in the security bulletin MS14-009.
How to obtain help and support for this security update
WARNING: Watch out for KB2898871!
Odds are, that it's gonna break your VS.
At least, it broke my VS 2013 Express for Desktop.
Trying to start VS resulted in a message saying "Operation could not be completed. No such interface supported."
Uninstalling an hiding the KB2898871 update solved the problem.
Now twitch can't be viewed without disabling security in is 8.1 64 bit.ms need to revisit this month patch and find an alternative way
I am new to the blog. I am having problems with .Net Framework 1.1, and 1.1 SP-1 They won't load from Microsoft. I know I am not the only person having this problem as another person logged in saying the same thing. It stops loading during installation. Any suggestions would be helpful, as I can't install my Back-up without it....
Hi Pax, we'd like to work with you to investigate further. Could you please reach out to netfx45compat at Microsoft dot com?
@The .NET Fundamentals Team
Thank you for responding.
IGNORE PREVIOUS WARNING!!!
After communicating with MS, who have been more than helpful, we (they) found that I had a corrupt file (System.Windows.Forms.dll), most likely due to a faulty harddrive.
Replacing the file solved the problem immediately.
I won't go into all the details, but there were a lot of mails going back and forth, with logs to create, things to try etc. MS have really gone "above and beyond" for a little nobody like me, and, as mentioned, it turned out not to be their fault at all.
So with that, I want to thank everybody at MS (There were a lot of people involved in the mail correspondance) for excellent service and support.