The Brotli vulnerability in .NET
Microsoft has released an emergency security update to address a significant flaw in how the .NET framework handles data compression. The issue originates in a library called Brotli, which was developed by Google and is used widely to compress data so that websites and applications load faster.
The vulnerability is classified as a buffer overflow. This occurs when a program tries to write more data to a temporary storage area than it can hold, which can cause the system to crash or allow an attacker to run their own malicious instructions. Because .NET is a core component of many Windows-based business applications, this flaw has a broad reach.
Risks to business operations
If a server or workstation is running an unpatched version of .NET, an attacker could potentially gain control over the system by sending a specially crafted compressed file. This could lead to data theft, the installation of malware, or the disruption of services.
This is not limited to public-facing websites. Internal business tools, human resources portals, and accounting software built on the .NET framework are also susceptible if they process data using the Brotli compression method.
Required actions
Microsoft has made the fixes available through standard update channels. For most UK small businesses, this means the patch will be included in the latest round of Windows Updates.
We recommend the following steps: 1. Verify that your servers and workstations are set to receive and apply security updates automatically. 2. If you host custom-built software, contact your developers to ensure their application environment is updated to the latest version of .NET. 3. Monitor for any service interruptions following the update, though Microsoft reports the fix is intended to be compatible with existing configurations.
Ark Assist is currently monitoring client systems to ensure these patches are applied as they become available. If you manage your own updates, ensure .NET versions 6.0, 7.0, and 8.0 (or newer) are fully updated.