Newsgroup: it.news.net-abuse
Titolo: E' Spam?


Reply-To: 
aspn...@email.microsoft.com
To: x
Subject: Alert - 
ASP.NET
 Security Issue and Guidance
Errors-To: 
aspn...@email.microsoft.com
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="---=_NEXT_ff6edbb81a"
X-eid: 1.5.Gb.BJ.11HQCS.BugXxe..M..1Gg0.25PH6i
X-pid: 330368
X-purgate-ID: 149301::041006172940-29E4-1D9316DE 0:1
X-purgate-Ad: Checked for SPAM by eleven - eXpurgate 
www.eXpurgate.net
X-purgate: This mail is sent in bulk
X-purgate: bulk
Return-Path: 
aspn...@email.microsoft.com
X-OriginalArrivalTime: 06 Oct 2004 15:28:17.0713 (UTC) FILETIME=[1A9ECA10:01C4ABB9]
-----=_NEXT_ff6edbb81a
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Dear 
ASP.NET
 Customer,=20
=20
This alert is to advise you of the availability of a web page that=20
discusses an investigation Microsoft is currently conducting into=20
public reports of a security vulnerability in 
ASP.NET
.  A malicious=20
user could provide a specially-formed URL that could result in the=20
unintended serving of secured content. =20
=20
This alert is also to advise you of the availability of a new=20
Microsoft Knowledge Base article: 887459.  This article contains=20
prescriptive guidance with steps customers can implement on their=20
ASP.NET
 applications to help protect against a wide variety of=20
malformed URL attacks.=20
=20
Microsoft is providing this prescriptive guidance in order to inform=20
customers as quickly as possible about the vulnerability and=20
information on how to prevent an attack.  Microsoft is actively=20
investigating this issue and plans to release additional guidance=20
and a security update to remedy the issue as soon as possible.=20
The Microsoft Knowledge Base article can be viewed here:=20
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cide.1Gg0.3anHCT=
=20
=20
The web page that discusses the current investigation into the=20
public reports of a vulnerability in ASP.Net can be viewed here:=20
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cidg.1Gg0.3b7nCV=
=20
=20
If you have any questions, please see the discussion in the 
ASP.NET
=20
Security Forums at:=20
=20
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cidi.1Gg0.3bUHCX=
=20
=20
=20
Thank you,=20
The Microsoft 
ASP.NET
 Team=20
=20
=20
=A9 2004 Microsoft Corporation. All rights reserved. Microsoft is a=20
registered trademark of Microsoft Corporation in the United States=20
and/or other countries.=20
=20
Protect Your PC: 3 steps to help ensure your PC is protected=20
Microsoft wants to help ensure your PC is protected from viruses and=20
worms like Mydoom and Blaster, as well as from future threats.=20
Please go to 
microsoft.com/protect
 and follow these steps today. =20
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cidk.1Gg0.3bqnCZ
 =
=20
=20
     1. Use an Internet Firewall=20
     2. Update Your Computer=20
     3. Use Up-to-Date Antivirus Software=20
=20
To get more information and resources about how to help protect your=20
PC, go to 
microsoft.com/protect
. =20
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cidk.1Gg0.3bqnCZ
 =
=20
=20
Review our Privacy Statement. =20
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cidm.1Gg0.3cBHCb
 =
=20
=20
If you prefer not to receive future promotional e-mails of this type=20
from Microsoft, please click below to unsubscribe. We will promptly=20
update your preferences; however, you may still receive previously=20
initiated promotional communications from Microsoft. =20
http://p.email.microsoft.com/m/u/mst/emd/m.asp?e=3D
<>nome%40<address>=
&cid=3D12761833192=20
=20
This e-mail is intended for distribution within the United States.=20
Please contact your local Microsoft=AE Subsidiary for similar=20
offerings outside the U.S.=20
=20
Microsoft Corporation=20
One Microsoft Way=20
Redmond, WA 98052 =20
=20
=20
=20
=20
   =20
-----=_NEXT_ff6edbb81a
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
<HTML>
<BODY>
<font face=3D"arial, helvetica" size=3D"2">Dear 
ASP.NET
 Customer, <BR>
 <BR>
This alert is to advise you of the availability of a web page that <BR>
discusses an investigation Microsoft is currently conducting into <BR>
public reports of a security vulnerability in 
ASP.NET
.  A malicious <BR>
user could provide a specially-formed URL that could result in the <BR>
unintended serving of secured content.  <BR>
 <BR>
This alert is also to advise you of the availability of a new <BR>
Microsoft Knowledge Base article: 887459.  This article contains <BR>
prescriptive guidance with steps customers can implement on their <BR>
ASP.NET
 applications to help protect against a wide variety of <BR>
malformed URL attacks. <BR>
 <BR>
Microsoft is providing this prescriptive guidance in order to inform <BR>
customers as quickly as possible about the vulnerability and <BR>
information on how to prevent an attack.  Microsoft is actively <BR>
investigating this issue and plans to release additional guidance <BR>
and a security update to remedy the issue as soon as possible. <BR>
The Microsoft Knowledge Base article can be viewed here: <BR>
<A HREF=3D"
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cide.1=
Gg0.3anHCT">
http://support.microsoft.com/?kbid=3D887459
</A> <BR>
 <BR>
The web page that discusses the current investigation into the <BR>
public reports of a vulnerability in ASP.Net can be viewed here: <BR>
<A HREF=3D"
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cidg.1=
Gg0.3b7nCV">
http://www.microsoft.com/security/incident/aspnet.mspx
</A> <BR>
 <BR>
If you have any questions, please see the discussion in the 
ASP.NET
 <BR>
Security Forums at: <BR>
 <BR>
<A HREF=3D"
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe..M.Cidi.1=
Gg0.3bUHCX">
http://www.asp.net/Forums/ShowForum.aspx?tabindex=3D1&ForumID=
=3D25</A> <BR>
 <BR>
 <BR>
Thank you, <BR>
The Microsoft 
ASP.NET
 Team <BR>
 <BR>
 <BR>
<font size=3D"1">=A9 2004 Microsoft Corporation. All rights reserved. Micro=
soft is a <BR>
registered trademark of Microsoft Corporation in the United States <BR>
and/or other countries. <BR>
 <BR>
Protect Your PC: 3 steps to help ensure your PC is protected <BR>
Microsoft wants to help ensure your PC is protected from viruses and <BR>
worms like Mydoom and Blaster, as well as from future threats. <BR>
Please go to <A HREF=3D"
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.Bug=
Xxe..M.Cidk.1Gg0.3bqnCZ">
www.microsoft.com/protect
</A> and follow these ste=
ps today.  <BR>
 <BR>
=A0=A0=A0=A0=A01. Use an Internet Firewall <BR>
=A0=A0=A0=A0=A02. Update Your Computer <BR>
=A0=A0=A0=A0=A03. Use Up-to-Date Antivirus Software <BR>
 <BR>
To get more information and resources about how to help protect your <BR>
PC, go to <A HREF=3D"
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXxe=
=2E.M.Cidk.1Gg0.3bqnCZ">
www.microsoft.com/protect
</A>.  <BR>
 <BR>
Review our <A HREF=3D"
http://r.email.microsoft.com/r?1.1.Gb.BJ.11HQCS.BugXx=
e..M.Cidm.1Gg0.3cBHCb">Privacy Statement</A>.  <BR>
 <BR>
If you prefer not to receive future promotional e-mails of this type <BR>
from Microsoft, please <A HREF=3D"
http://p.email.microsoft.com/m/u/mst/emd/=
m.asp?e=3D<nome>%40<address>&cid=3D12761833192">click here</A>=
 to unsubscribe. We will promptly <BR>
update your preferences; however, you may still receive previously <BR>
initiated promotional communications from Microsoft.  <BR>
 <BR>
This e-mail is intended for distribution within the United States. <BR>
Please contact your local Microsoft=AE Subsidiary for similar <BR>
offerings outside the U.S. <BR>
 <BR>
Microsoft Corporation <BR>
One Microsoft Way <BR>
Redmond, WA 98052 </font> <BR>
 <BR>
 <BR>
 <BR>
 <BR>
<font size=3D"1"></font> </font>   <BR>
<img width=3D"1" height=3D"1" src=3D"
http://open.delivery.net/o?1.2.Gb.BJ.1=
1HQCS.BugXxe..M..1Gg0.ZD0w3QSnBk" alt=3D" ">
</BODY>
</HTML>
-----=_NEXT_ff6edbb81a--

> Che ne pensate voi di questa mail?
Spam .. e forse tentativo di infezione
usando un JPEG "truccato" o altro...
Ciao

 wrote in news:2sk8jbF1loed2U1
@
uni-berlin.de
:

Eppure..uno dei link riportati nel body è
http://www.asp.net/Forums/ShowForum.aspx?tabindex=1&ForumID=25
che fa riferimento a
http://www.microsoft.com/security/incident/aspnet.mspx
 
-- 
Ciao,
Paola
http://it.photos.yahoo.com/brixina

 This e-mail is intended for distribution within the United States.=20
Era diretta a un indirizzo .it o altro?
In questo caso penso possa meritare aprire un caso con l'abuse desk di
Digital Impact; mi aspetto una risposta professionale in cui indichino
chiaramente le circostanze in cui il destinatario ha dato il consenso.
Se poi cosi' non e', pronti a riconsiderare tutto il quadro.
furio

> Eppure..uno dei link riportati nel body è
:-D
Ciao

Received: from 
email.microsoft.com
 (209.11.138.101)
  by 
mh.microsoft.m0.net
 with ESMTP; 06 Oct 2004 08:29:14 -0700
Operazione: query DNS per l'host: 
email.microsoft.com
209.11.136.150
Operazione: reverse DNS per l'indirizzo: 209.11.136.150
209.11.136.150 corrisponde a: 
redirect.merchantmail.net
Attenzione: qualsiasi reverse DNS potrebbe essere falso.
Occorre verificare con il DNS diretto:
Operazione: query DNS per l'host: 
redirect.merchantmail.net
209.11.136.150
-------
Operazione: reverse DNS per l'indirizzo: 209.11.138.101
209.11.138.101 corrisponde a: 
fac601.m0.net
Attenzione: qualsiasi reverse DNS potrebbe essere falso.
Occorre verificare con il DNS diretto:
Operazione: query DNS per l'host: 
fac601.m0.net
209.11.138.101
---------------------------------------------------------------
Ma e' proprio la Microsoft che l'ha mandata oppure no?
Ciao e grazie
---
Maurizio

 Ma e' proprio la Microsoft che l'ha mandata oppure no?
Mi sembra abbastanza chiaro che Microsoft si e' rivolta a
Digital Impact per questa promozione.  Uno dei rari casi in
cui Microsoft capisce di non avere le competenze per fare
qualcosa in casa e delega in outsourcing a un professionista.
Lo facessero anche per i sistemi operativi..
furio

 Lo facessero anche per i sistemi operativi..
a dire il vero lo fanno :) prendi windowsupdate. Non so se ci hai 
fatto caso ma negli aggiornamenti automatici il collegamento non va 
in un IP della rete M$ ma ad una nota società esterna ..
-- 
Ciao, Dmitry
X-Privat F.A.Q. : 
http://www.x-privat.org/faq.php