Microsoft Security Bulletin MS10-077 - Critical, Vulnerability in .NET Framework Could Allow Remote Code Execution (2160841)
Affected products/components: .NET Framework 4

More details about the versions affected by this vulnerability can be found in the security bulletin MS10-077.

Please remember that customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. Customers outside the U.S. and Canada can find a local support number here. There is no charge for support calls that are associated with security updates.

There will be a webcast for the bulletin release on October 13, 2010 at 11:00 AM Pacific Time (US & Canada), where we will present information on the bulletin and take customer questions. If you are interested in attending the webcast, click here to sign up.

Thanks,
Jamshed Damkewala
Senior Lead Program Manager, .NET Framework Sustained Engineering Team

Sep 30th Update: Today this update was also made available on Windows Update and WSUS.

Microsoft Security Bulletin MS10-070 - Important, Vulnerability in ASP.NET Could Allow Information Disclosure (2418042)
Affected products/components: .NET Framework 1.1 SP1, .NET Framework 2.0 SP2, .NET Framework 3.5, .NET Framework 3.5 SP1, .NET Framework 4

More details about the versions affected by this vulnerability can be found in the security bulletin MS10-070 and also on ScottGu's blog and the SRD blog.

Please remember that customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. Customers outside the U.S. and Canada can find a local support number here. There is no charge for support calls that are associated with security updates.

We will also hold a webcast for the bulletin release on Tuesday, September 28, 2010 at 1:00 PM PDT, where we will present information on the bulletin and take customer questions. If you are interested in attending the webcast, click here to sign up.

Thanks,
Jamshed Damkewala
Senior Lead Program Manager, .NET Framework Sustained Engineering Team

Visual Studio 2010 Tools for Office Runtime Update (KB982305)
Affected products/components: Visual Studio 2010 Tools for Office Runtime
More information about this update can be found in the KB article 982305.

Thanks,
Jamshed Damkewala
Senior Lead Program Manager, DevDiv Sustained Engineering Team

Visual Studio 2010 Lab Management Update (KB983578)
Affected products/components: Visual Studio 2010
More information about this update can be found in the KB article 983578.

Visual Studio 2010 Video Diagnostic Data Adapter Update (KB2160831)
Affected products/components: Visual Studio 2010
More information about this update can be found in the KB article 2160831.

Visual Studio Team Foundation Server 2010 Update (KB2135068)
Affected products/components: Visual Studio Team Foundation Server 2010
More information about this update can be found in the KB article 2135068.

Thanks,
Jamshed Damkewala
Senior Lead Program Manager, DevDiv Sustained Engineering Team

Microsoft Security Bulletin MS10-060 - Critical, Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution (2265906)
Affected products/components: .NET Framework 2.0 SP2, .NET Framework 3.5, .NET Framework 3.5 SP1, Silverlight 3

More details about the versions affected by this vulnerability can be found in the security bulletin MS10-060.

Please remember that customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.

Thanks,
Jamshed Damkewala
Senior Lead Program Manager, DevDiv Sustained Engineering Team

We often see requests from customers writing apps based on the .NET Framework asking how they might detect the different versions of the .NET Framework in their application setup, the DevDiv SE team has been working on updating documentation for this.

We realize that different customers have different needs,

• they may need to detect a particular major version of the Framework while being agnostic to the SP level e.g. .NET Framework 2.0 at any Service Pack level, this is important when the a custom app uses the features of that particular major version.
• they may need to detect a particular major version and a specific Service Pack level of the .NET Framework e.g. .NET Framework 2.0 Service Pack 2, this is important when their app may only have been tested on that particular version/Service Pack level.
• they may need to detect a particular major version and a minimum Service Pack level of the .NET Framework e.g. .NET Framework 2.0 Service Pack 2+ , this is important when the app may require a specific feature which didnt exist when the version first released but was introduced in a Service Pack.

With this documentation we have tried to address all 3 types of uses. Let us know if you want to see something else here.

Thanks,
Jamshed Damkewala
Lead Program Manager, DevDiv Sustained Engineering Team

The .NET Framework 4 is available in 2 flavors – the .NET Framework 4 Client Profile (for client platforms such as Windows XP, Windows Vista, and Windows 7) and the .NET Framework 4 (with additional features for server platforms such as Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2).

If you are wondering, one of the goals of the .NET Framework 4 was to make it non-impactful to existing applications, so the .NET Framework 4 is a side-by-side release with earlier versions of the .NET Framework. Therefore, if you are running applications based on an earlier version these applications will this be automatically upgraded to use the newer version. For enterprise customers that may have unique business requirements and do not want to have the .NET Framework 4 deployed to their machines, this KB article describes how you can block the deployment of the .NET Framework 4 in your environment.

You can find more information about the .NET Framework here.

Thanks,
Jamshed Damkewala
Lead Program Manager, DevDiv Sustained Engineering Team

.NET Framework 3.5 Service Pack 1 Update (KB982524, KB956250, KB982525, KB982526)
Affected products/components: .NET Framework 3.5 SP1

The update has a couple of different KB articles depending upon what your target platform (OS and SP level) is.

Windows XP, Windows Server 2003: KB982524
Windows Vista SP1: KB956250
Windows Vista SP2: KB982525
Windows 7, Windows Server 2008 R2: KB982526

Thanks,
Jamshed Damkewala
Senior Lead Program Manager, DevDiv Sustained Engineering Team

More information around support policies for the Microsoft .NET Framework can be found here: https://support.microsoft.com/gp/lifeandotnet

More information regarding new versions of the Microsoft .NET Framework can be found in the Knowledge Base Article 829019.

ADO.NET Data Services Update for .NET Framework 3.5 SP1 (KB976126, KB976127)
Affected products/components: .NET Framework 3.5 SP1 and .NET Framework 3.5.1
More information about this update can be found in the KB articles 976126 and 976127.

.NET Framework 2.0 Service Pack 2 and .NET Framework 3.0 Service Pack 2 Update (KB976569, KB976570)
Affected products/components: .NET Framework 2.0 SP2 and .NET Framework 3.0 SP2
More information about this update can be found in the KB articles 976569 and 976570.

Visual Studio Team System 2005 Service Pack 1 Forward Compatibility Update (KB979258)
Affected products/components: .NET Framework 2.0 SP2 and .NET Framework 3.0 SP2
More information about this update can be found in the KB article 979258.

Microsoft Security Bulletin MS10-022 - Important, Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution (981169)
Affected products/components: VBScript 5.1, VBScript 5.8, VBScript 5.7, VBScript 5.8
More information about this security update can be found in the security bulletin MS10-022. 

Microsoft Security Bulletin MS10-031 - Critical, Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)
Affected products/components: Visual Basic for Applications 6.2, 6.3, 6.4, 6.5.
More information about this security update can be found in the security bulletin MS10-031. 

Please remember that customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.

Thanks,
Jamshed Damkewala
Senior Lead Program Manager, DevDiv Sustained Engineering Team