RIP Quadrant. Adios, SSM Repository.

So it’s official.Kraig Brockschmidt has blogged an update on SQL Server Modelling.As widely rumoured, he has confirmed that Quadrant is dead. The shock is that the model repository has expired as well.
M is still hanging on in there, but we don’t know anything more about what the future holds. For some time, the official word has been that it would arrive in conjunction with a future SQL Server release.I detect a possible change here, in that Kraig simply says ‘We are continuing our investment in this technology and will share our plans for productization once they are concrete’. For my part, I maintain that tying ‘M’ to the SQL Server licence would be a really bad move.I know that every time Doug Purdy (who has recently left Microsoft to join Facebook) was challenged on this, he kept saying…no, SQL Server is a platform, not a product…watch this space. However, in the next breath it certainly sounded as if ‘M’ was in danger of being subsumed under a product license.No, no, no.Set it free to be used across Microsoft’s platform. That platform is not SQL Server. It remains Windows, and for developers, it is Windows (on-premises and cloud) mediated through .NET.

MsgBoxViewer 11 – Compatible for BizTalk  2010

MsgBoxViewer 11 – Compatible for BizTalk 2010

Hello

A long time I did not update my blog to announce a new version of my tool !  🙂

One of the reason is that I just changed of business to become an Escalation Engineer in SharePoint Developement Support; a lot of work and topics to learn in perspective so but I wanted to enlarge my skills set.
I change of business but I still continue to have an eye on BizTalk of course 🙂

I also spent some time these past months with my former BizTalk colleagues to try to identify  a process and people responsible for futur MBV updates, and help for quick and easy next updates of MBV.
I had so to change the MBV architecture and redesign completly my tool MBVQueryBuilder to make the query or rules update a task much more easy.
Next MBV updates might be done so mainly by the Biztalk Support team with my contribution.

Finaly I spent time to  update MBV to make it compatible for BizTalk 2010 (the Class Settings query reported indeed wrong changes for example) and this is this new version that I put here

This version  brings also two major changes :

 
1) MBV is compiled now to target .NET 2

You can ask yourself why MV was targeting until now only .NET 1.x ?? it is for the simple reason that MBV remained always compatible for BizTalk 2004 and that it should be able to run on BizTalk Server 2004 Servers where only .NET 1.x could be installed

This change means so that it can not run anymore on a BT 2004 box with ONLY .NET 1.X installed, but honestly do we meet frequently such configs now  ? 🙂  and anyway you know that you can run MBV on any type of Servers and not only BT ones
 
 
2) MBV is not anymore a single .EXE but it is composed now of the following files:

o   MYHC.DLL : Implement my custom Health Check engine

o   MYHCQUERIES_MBVQUERIES.DLL : Contains the entire MBV repository and custom Query functions to analyze a BizTalk Group      

o   MSGBOXVIEWER.EXE : GUI MBV Client tool

o   MBVCONSOLE.EXE : Console MBV Client tool

 
Reasons for this split are mainly the following ones:

o   Query repository grow too quickly, need so to separate it from the clients .exe
o   Health Check engine should be updated w/o the client tools using it
o   Need to update easily MBV Repository w/o recompiling the client tools
o   As MBV is just a client tool of my generic health Check engine, it can load any type of Query repository (DLL or XML) and not only the BizTalk one
 
You have the right to prefer the single binary version so in this case I can only suggest you to keep using  the old build 🙂 but you will not benefit of additional rules and queries

you can find this new version  here :

http://blogs.technet.com/b/jpierauc/archive/2007/12/18/msgboxviewer.aspx

 

As usual, feel free to report in this blog your feedbacks on the tool, your suggestions for new features or improvements, and any kind of problems you could meet using MBV

and many thanks to all of you who already sent me good feedbacks  ! 😉

 

JP

 

New Features :


–          Compatible for incoming BizTalk 2010
–          Add additional query to get retrieve part of Biztalk 2010 Dashboard Settings
–          Detect if CU3 is installed on each BT Server
–          Get Perfmon counters for ALL BT Servers (and not only the local server)
–          Get Perfmon counters for MsgBox Db SQL Servers (SQL General statisitcs, SQL locks, SQL Databases)
–          Add order delivery and other port settings in the “Send ports” query
–          Add query to get custom settings of each Send Port: Not checked by default
–          Add query to get custom settings of each Receive Location: Not checked by default
–          Check for small or default value in WCF ReceiveTimeout  binding property
–          Check for MQS port configured w/o Tx
–          Check for WMI prop “ClearAfter” too large value : Error CLSID_PropertBag
–          Format better BAM config info report output
–          Added Latest new MSDTC /COM+ packages version info
–          Get Last X rows from Spool and Instances  tables : rows number is configurable as a query property
–          Raise a warning in MBV if the CustomSD key is found under HKLM\System\Current Control Set\Services\Eventlog\Application
–          Rule to check for KB  980560
–          Rule to  check for KB  979709
–          Rule to check for KB  979095
–          Add more info in the “BizTalk Group” category of the SUMMARY REPORT section
–          Improved query to get sucessfully all GAC assemblies
–          Updated  Latest BT Mgmt Pack version check
–          Get Pipeline ID in Pipeline Query Report
–          Get the Transport Type used in “WCF Custom” port
–          Redesigned the DialogBox UI to add custom Rules and be able to raise different type of actions
–          Redesigned the main dialogbox of MsgBoxViewer.exe (gui version)

BizTalk Server 2010 Documentation – Beta and Posters

BizTalk Server 2010 Documentation – Beta is available through Microsoft Download Center. Here you will find documents like:

  • BizTalkServer2010.exe
  • BizTalkServer2010HXS.exe
  • Installing BizTalk Server 2010 and BAM in a Multi-Computer Environment.docx
  • Installing BizTalk Server 2010 on Windows 7 and Windows Vista.docx
  • Installing BizTalk Server 2010 on Windows Server 2008 R2 and 2008.docx
  • KWUserGuide.exe
  • PartyMigrationTool.exe
  • Troubleshooting BizTalk Server 2010 Setup.docx
  • Upgrading to BizTalk Server 2010 from BizTalk Server 2009 or 2006 R2.docx

Besides the documentation a new set of posters is available:

  • BizTalk Server 2010 BAM Poster
    This poster describes BizTalk Server 2010 BAM concepts, processes, and management for both new and experienced users.
  • BizTalk Server 2010 Runtime Architecture Poster
    The poster depicts message flow, data flow, and references that occur at runtime in BizTalk Server 2010.
  • BizTalk Server 2010 Capabilities Poster
    The poster provides a high-level and detailed view of BizTalk Server 2010 features and capabilities.
  • BizTalk Server 2010 Scale-out Configurations Poster
    This poster describes typical scale-out configurations and options for BizTalk Server 2010.
  • BizTalk Server 2010 ESB Toolkit Architecture Poster
    This interactive poster, created in Silverlight, depicts the architecture of the BizTalk Server 2010 ESB Toolkit. It shows the toolkit’s core components, and how these integrate with BizTalk Server.
  • BizTalk Server 2010 Database Infrastructure Poster
    This poster describes BizTalk Server 2010 databases and associated components, jobs, services, UI, and events.

Cheers.

Technorati: biztalk biztalk server 2010

Optimising VirtualBox

I blogged a couple of weeks ago about my issues running VirtualBox.At the time, I believed I had found an issue involving SuperFetch.In reality, turning SuperFetch off, while helpful, did not address the underlying issue.I eventually worked out that my machine is overheating whenever CPU usage of 40-50% is sustained over several minutes. Several things, or combinations of things, can cause this on my machine, including running full virus-checking scans in Forefront, SuperFetch and, of course, running VirtualBox. Every time the temperature goes up to about 85o, the power management throttles the CPU back to about 300MHz in order to let things cool down again. Once cooler (less than 80o), the CPU switches back to full speed. A cycle is set up that repeats for as long as the relatively high CPU load continues. I use the RightMark CPU Clock Utility to monitor core temperature.
The fan works OK, and my machine is not clogged with dust and detritus.It appears that my Dell Vostro 1720 simply cannot cope with sustained load. The Vostro range has documented overheating problems in relation to the NVidia GPU.Dell ended up modifying the BIOS to keep the fan running constantly to try to keep things cool.Sure enough, my fan never seems to switch off, but just can’t cope with sustained load.Short of convincing the company to buy me a new machine (some hope!), my only options are to adopt whatever strategy I can to reduce sustained CPU load to a minimum and to invest, at company expense, in a cooling pad.
How do I reduce sustained CPU load?Well, there are some challenges here.First, I avoid run full virus scans during working hours.Unfortunately, being a company machine, the policy is locked down and a full scan kicks off every Wednesday lunchtime.My only option has been to kill the scan and try to remember to run one manually before going to bed.
Turning SuperFetch off has helped.It doesn’t really use a huge number of cycles, but it does increase CPU load for several minutes at a time at certain times of the day.In combination with other things, this can be enough to cause my machine to overheat.I haven’t missed SuperFetch except when re-booting, which now takes a lot longer.
And now on to VirtualBox.I’m very dependent on running virtual images on my notebook for development, demonstrations, etc.Although Microsoft includes virtualisation with Windows 7, this is not an option for me.Microsoft only supports 32-bit images and, far worse, my experience was that most of my existing VPC 2007 images simply won’t run under the new WinVPC.Hence, I, like everyone else I know, have now switched to Sun/Oracle VirtualBox which happily runs all my old 32 bit images and allows me to create 64-bit images.Indeed, Microsoft is quite explicit on their web site that they only see WinVPC as a mechanism for handling legacy 32-bit apps that won’t run properly on Windows 7.I have yet to encounter any application that won’t run on Windows 7, so this strategy does little for me.
Unfortunately, VirtualBox can be quite intensive in terms of CPU usage, and causes my machine to overheat.Even if the image is completely idle, VirtualBox can constantly consume 30-50% CPU.I’ve been struggling with this for some time.Here is a summary of strategies to reduce CPU load:
On a single processor, dual core machine, configure each image to use a single virtual processor.This seems to help.I haven’t tested this on multi-processor boxes, so can’t say if the rule should be ‘always use a single virtual processor’ or ‘always use one less virtual processor than the physical processor/core count.
Avoid Oracle VirtualBox 3.2.8 and instead opt to use the old Sun VirtualBox 3.1.8 which is still available.The Sun version seems to be a bit less intensive than the current Oracle version.Oracle certainly introduced a number of changes and seems to burn through more CPU cycles.
And now, something I recently discovered. Try moving to SATA disk controllers. This has worked well for me.One of our system guys tells me that he suspects this better aligns VirtualBox with the controllers used on most modern notebooks, and cuts down the amount of work the machine has to do.I don’t know if this is correct, but I certainly see a significantly reduced load on the machine.
To move to SATA disk controllers, you need to stop you image and then go to ‘Settings/Storage’.Under the ‘Storage Tree’ panel, click the ‘Add Controller’ button and choose ‘Add SATA controller’.Now boot the image and make sure it has a valid network connection with Internet access.To load the required drivers, go to the Intel web site and download the latest version of their Matrix Storage Manager.You can currently find this on this page:
http://downloadcenter.intel.com/SearchResult.aspx?lang=eng&ProductFamily=Chipsets&ProductLine=Chipset+Software&ProductProduct=Intel%c2%ae+Rapid+Storage+Technology+(Intel%c2%ae+RST)
Once the manager is installed, shut down the image.Then go back to ‘Settings/Storage’, remove your hard disk from its current controller and add it to the SATA controller.Reboot you image, and hopefully things will improve.
Finally, if you have the same problems I have, invest in a cooling pad.Mine arrive at lunchtime today just in time for me to test it during a full Forefront scan.I placed the notebook on the pad, plugged it into my USB port (to run the fan) and watched the temperature reduce down by about 12/13o. For the next few hours it ran the full scan without going much above 60o, which is well inside the safety zone. At the same time, I was running, and using, VirtualBox. The scan is complete and I am down to about 54o. This still strikes me as a tad on the warm side, and I have to say I think there is probably some underlying fault on my machine, but our systems guys feel differently. So, for the time being, armed with VirtalBox optimisations and a cooling pad, I can once more enjoy a productive relationship with my notebook.

BizTalk Server 2010 released for manufacturing!!!

BizTalk Server 2010 has been released to manufacturing and will be available for purchase starting October 1st, 2010. The evaluation and free Developer editions are now available for download from the BizTalk Server website.

BizTalk Server 2010 is the seventh major release of Microsoft enterprise integration product for connecting systems within and across enterprises. BizTalk Server 2010 has 4 major themes – to help customers to:

·         Integrate Enterprise Applications Easily

·         Manage and Tune Solutions easily

·         Enhance Enterprise Interoperability

Let us look at each of themes in detail.

Theme: Integrate Enterprise Applications Easily

BizTalk Server 2010 helps developers put together applications that integrate various heterogeneous systems in an enterprise easily.  There are a number of new features and enhancements to the existing features that enable this easy integration.

Seamless access and mapping to Line-of-Business applications for new users and new scenarios

BizTalk Server 2010 includes out of box activities to connect and map data for AppFabric (.NET) developers. With these activities customers can now connect to LOB systems very easily and also use the award winning BizTalk Mapper and the mapping functionality within AppFabric.

 With this feature BizTalk Server 2010 now enables:

·         Out of box Line of Business Connectivity

·         Includes message data transformation

·         Delivered as WF 4.0 activities

·         Utilize existing BizTalk engine and tools

·         BizTalk LoB Adapters (SAP, Oracle, Siebel, Oracle DB, SQL Server)

·         Transformation Engine and Mapper

·         Provide LoB connectivity for scenarios that need better performance rather than reliability and control (e.g. Web)

·         Enables customers to develop solutions that need higher performance without the durability and reliability constraints.

More posts with detailed information on LOB access and mapper activities in AppFabric are here, here, here, and here.

 Better design experience of data transformation (maps)

The Mapper in BizTalk Server 2010 has been redesigned and enhanced to work easily with complex maps.

 A few highlights of the new Mapper are:

·         Reduce background “noise” using highlight propagation to show only the nodes that are relevant to the user

·         Auto-scrolling and coalescing of sibling nodes to help locate the nodes of interest easily

·         Search functionality to find the nodes of interest easily especially in large and complex maps

·         Improve productivity with Cut/Copy/Paste/Move/Undo functionality

·         Predictive match that help create maps faster 

More details on the new Mapper are available here.   

Built-in components for rapid development of RFID solutions

BizTalk Server 2010 helps developers build RFID solutions faster by providing out of box event handlers for duplicate elimination, TDT based filtering and dwell filtering. It also provides out of box mechanism for .NET apps to subscribe to RFID events, post events to BizTalk Server and also post EPCIS events to a Capture Service.

Theme: Manage and Tune Solutions easily

BizTalk Server 2010 helps IT Pros to easily tune their systems for performance and also manage their systems easily.  With the below features in BizTalk Server 2010, it is easier and faster to just get things done.

·         Easier to setup and update and migrate

·         Efficient performance and tuning and setting of run-time parameters with finer setting granularity and more intuitive and accessible settings

·         Better visibility and control of production environment with a new System Center Operations Management Pack

·         Enhanced security with Transparent Message Data Encryption

·         Compression option to speed up backup tasks

Let us look at the enhancements to settings and SCOM pack in details.

Settings Dashboard:

All the settings related to performance tuning are now consolidated in a single dashboard which is accessible from the Management Console. This settings dashboard provides:

·         Dashboard view for all performance related settings consolidated in a single place

·         Granular setting level options: group, host and host instance

·         For example – MaxReceiveInterval which is used to tune BizTalk solutions for high performance is now available at the host level. It is also split into separate settings – MessagePollingInterval and OrchestrationPollingInterval

·         Uniform access to settings through APIs

·         Ability to replicate settings between deployments using scriptable Export/Import operations

System Center Operations Manager Pack:

The SCOM pack has been redesigned and remodeled to help IT Professionals to easily monitor BizTalk installations and diagnose any problems. This is enabled with the enhancements below:

·         New model with separate application and deployment views

·         New alerts and diagnostics

·         Single representation of artifacts in a multi machine deployment

Upgrade Support:

The last two versions of BizTalk Server – BizTalk Server 2006 R2 and BizTalk Server 2009 can be upgraded to BizTalk Server 2010 seamlessly in-place.

 Theme: Enhance Enterprise Interoperability

BizTalk Server 2010 increases enterprise interoperability with the new, scalable TPM (Trading Partner Management) and new and enhanced Adapters and Accelerators. Now we will look at each of these in detail.

Scalable Trading Partner Management:

 

The new TPM enables easy on-boarding and lifecycle management of trading partners with the following features:

·         New Partner Management model that reflects typical B2B relationships.

·         Better and more accessible user interface with

·         Agreement templates and business profiles for rapid configuration

·         New TPM operator role to manage partner management

 

Another post with more details on TPM is here.

 

New and enhanced Adapters:

·         New FTPS adapter

·         Enhanced FTP Adapter

·        Supports files from read-only locations

·         Extends atomic write to text files

·         Fault tolerance and performance improvements

·         Support for new versions of LOB systems

·         Oracle EBS 12.1

·         SAP 7

·         JD Edwards 9.0

·         SharePoint 2010

·         SQL Server 2008 R2

·         Support for new Microsoft platforms

·         Windows Server 2008 R2

·         SQL Server 2008 R2

·         .NET Framework 4.0

·         Visual Studio 2010

 

As we discussed in this blog today, with the focus on making developing, tuning, and managing enterprise integration solutions and managing trading partners faster, simpler and easier, we hope that BizTalk Server 2010 will make it easy for enterprises to build composite solutions that span both on-premise LOB systems and also applications deployed onto the public cloud.

 

Here is another post that discusses the features of BizTalk Server 2010 along with a video.

Learn BizTalk Server 2010 at your own pace here.

 

To learn more regarding the BizTalk Server 2010 release and download our new free developer edition, please visit BizTalk Server website. You can learn more about Microsoft’s Application Infrastructure capabilities by exploring on-demand training at www.appinfrastructure.com.

 

BizTalk Sftp Adapter – New release 1.4 available on CodePlex

I’ve got quite a few request for Proxy support through the years, and eventually someone (no names) got tired of waiting, hired me as a consultant, and forced me to implement it. So I’m happy to say the adapter now comes with support for HTTP Proxy.

Support has also been added to:

  1. Enable "%UniversalDateTime%" macro on Receive Location (rename)
  2. "Leave File" on the Receive Location.
  3. Not throwing 10.000 exception to the eventlog (yes this is a feature)

Thanks to everyone giving feed-back through the codeplex site.

If you like it, please rate the project (If you don’t like it, you should not feel obligated to do so)

You will still need to set the appropriate SSH parameters such as SSH Host, User name and Remote path. These parameters will be sent to the proxy server, which in turn will act as “man-in-the-middle” and connect to the SSH server using the parameters provided by the adapter.

Using the WCF OperationContext from a Receive activity

The WF4 Receive activity shields you from a lot of the WCF pipeline. Normally that is a good thing but there are occasions where you want to know more about the incoming WCF request. Normally you can use the WCF OperationContext.Current to get at this information but with a workflow service this doesn’t work as it is null. The reason is that the workflow executes on a different thread.

 

So how do you get at the OperationContext?

The trick is to add a class implementing the IReceiveMessageCallback interface to the NativeActivityContext.Properties while the receive is executing and this will have it’s OnReceiveMessage() function executed with the OperationContext passed in. This means creating an activity to wrap the Receive activity like this.

public class GetMessageProperties : NativeActivity
{
    public Activity Body { get; set; }
 
    protected override void Execute(NativeActivityContext context)
    {
        var inspector = new GetMessagePropertiesInspector();
        context.Properties.Add(inspector.GetType().FullName, inspector);
        context.ScheduleActivity(Body, OnBodyCompleted);
    }
 
    private void OnBodyCompleted(NativeActivityContext context, ActivityInstance instance)
    {
        var inspector = context.Properties.Find(typeof(GetMessagePropertiesInspector).FullName) as GetMessagePropertiesInspector;
        if (inspector != null)
        {
            Console.WriteLine("ClientUri = {0}", inspector.ClientAddress);
        }
    }
}

 

The GetMessagePropertiesInspector, which implements the IReceiveMessageCallback, is quite simple. The main thing here is that it can be serialized along with the workflow state so make sure it contains the DataContract attribute.

[DataContract]
public class GetMessagePropertiesInspector : IReceiveMessageCallback
{
    [DataMember]
    public string ClientAddress { get; set; }
 
    public void OnReceiveMessage(OperationContext operationContext, ExecutionProperties activityExecutionProperties)
    {
        var properties = operationContext.IncomingMessageProperties;
        var endpoint = properties[RemoteEndpointMessageProperty.Name] as RemoteEndpointMessageProperty;
        ClientAddress = endpoint.Address;
    }
}

 

Creating and self hosting the workflow in a console app is easy, if you want to use the designer you will need to add an ActivityDesigner as well and you are good to go.

class Program
{
    static void Main(string[] args)
    {
        var workflow = CreateWorkflow();
        var host = new WorkflowServiceHost(workflow, new Uri("http://localhost:8080/MyService"));
 
        host.AddDefaultEndpoints();
 
        host.Open();
 
        Console.ReadLine();
        host.Close();
    }
 
    private static Activity CreateWorkflow()
    {
        var result = new Sequence();
 
 
        var receive = new Receive();
        receive.OperationName = "GetData";
        receive.CanCreateInstance = true;
 
        result.Activities.Add(new GetMessageProperties() { Body = receive });
        result.Activities.Add(new SendReply() { Request = receive });
 
        return result;
    }
}

 

If you want to work with the reply message there is also a ISendMessageCallback which does exactly the same for the result message.

 

Enjoy!

www.TheProblemSolver.nl

Wiki.WindowsWorkflowFoundation.eu

Frequently Asked Questions about the ASP.NET Security Vulnerability

Two days ago I published an important blog post about a security vulnerability in ASP.NET.  In it I discussed a workaround that we recommend customers use to help prevent attackers from using the vulnerability against your applications.

Below are answers to some common questions people have asked since then about the vulnerability.

Is Microsoft going to release an update to fix the vulnerability?

Yes.  We are working on an update to ASP.NET that we will release via Windows Update once it has been thoroughly tested and is ready for broad distribution.

Until the update is available, we will also publish details on workarounds (like the one described in this post) that can be applied immediately to help protect against the vulnerability.  Note that the workarounds are temporary – and will not be required once the update fixes the vulnerability in the underlying products.  They are intended to provide steps that you can take immediately until the update is available.

Is this an issue in ASP.NET or is it some cryptographic vulnerability?

This is a vulnerability in how ASP.NET uses cryptography in some circumstances that enables side-channel leaks through error responses.  The current ASP.NET use of encryption padding provides information in error responses that can be used by a malicious party.  We will be fixing this vulnerability in the security update.

Does this affect both ASP.NET Web Forms and ASP.NET MVC?

Yes – the publicly disclosed exploit can be used against all types of ASP.NET Applications (including both Web Forms and MVC).

Does this affect SharePoint?

Yes – the publicly disclosed exploit can also be used against SharePoint 2010.  The SharePoint team recently published a blog post that describes a workaround you can apply until we release the security update.

What would an attack look like on the network or in my logs?

The publicly disclosed exploit would cause the web server to generate thousands (or more likely tens of thousands) of HTTP 500 and 404 error responses to requests from a malicious client.

You can use stateful filters in your firewall or intrusion detection systems on your network to detect such patterns and block such clients.  The Dynamic IP Restrictions module supported by IIS 7 can also be used to block these types of attacks.

An attack attempt like this should also generate thousands of warnings in the application event log of your server similar to:

Event code: 3005

Event message: An unhandled exception has occurred.

Event time: 11/11/1111 11:11:11 AM

Application information:

    Application domain: c1db5830-1-129291000036654651

    Application Virtual Path: /

Exception information:

    Exception type: CryptographicException

    Exception message: Padding is invalid and cannot be removed.

Note that there are non-attack reasons to see this error as well (including cases where you have mismatched keys on a web-farm, or a search engine is following links incorrectly, etc), so its presence does not necessarily indicate an attack. 

The exception also does not mean that an attack was successful.  Implementing the <customErrors> workaround we have provided can protect your application from the public exploit, and ensure that these exceptions do not disclose information that an attacker can use against the application.

What does the <customErrors> workaround do?

A workaround you can use to protect your application from the public exploit is to enable the <customErrors> feature of ASP.NET, and explicitly configure your applications to always return the same error response – regardless of the error encountered on the server.  By mapping all error pages to a single error page, you can make it more difficult for an attacker using the public exploit to distinguish between the different types of errors that occur on a server. I covered how to implement the workaround in this blog post.

If you are using .NET Framework version 3.5 SP1 or 4.0, the workaround provides further protection by also helping to mitigate against potential timing analysis attacks.  The workaround uses the redirectMode="ResponseRewrite" option in the customErrors feature, and introduces a random delay in the error page.  These approaches work together to make it more difficult for an attacker to deduce the type of error that occurred on the server by measuring the time it took to receive the error.

Can I configure a custom 404 error page response and a default redirect for all other errors?

No. By doing this you are still letting an attacker draw distinction between a 404 and other errors. Homogenizing errors is a crucial component to mitigating this attack.  Note that this is a workaround until a security patch is available to fix the underlying product vulnerability. This workaround will not be required once we release a security update.

Am I vulnerable if I have my own custom error module?

If the responses that are sent out from your custom logging module do not let the client distinguish between error responses either through its content or time that it takes to serve out, then such a module is an adequate replacement for the customErrors workaround. These responses include both the entire HTTP response and the HTTP error code. If any of the above is not true at all times, then this is not sufficient.  Instead you should send out the same error response for all errors until the security update is available to fix the underlying vulnerability.

Should I be concerned about this vulnerability if I don’t store any sensitive information in my viewstate?

Yes you should.  There is a combination of attacks that was publicly demonstrated that can leak the contents of your web.config file, including any sensitive, unencrypted, information in the file.  You should apply the workaround to block the padding oracle attack in its initial stage of the attack.  The security update will fix this vulnerability.

What are best practices to secure my data within the web.config file?

It is always a best practice to encrypt sensitive configuration data within web.config files. That way if your web.config file is ever exposed, attackers can not use its contents maliciously.  This MSDN documentation describes how to encrypt web.config file configuration sections: http://msdn.microsoft.com/en-us/library/zhhddkxy(VS.80).aspx.  This tutorial also provides more samples of how to encrypt web.config file contents: http://www.4guysfromrolla.com/articles/021506-1.aspx

Why am I getting an error running the vulnerability detection .vbs script?

In my initial blog post I pointed at a .vbs script that you can run against a server to identify any applications within it that need to have their <customErrors> sections updated as a workaround against the publicly disclosed exploit. 

On IIS 7, the script requires you to have the IIS 6 management compatibility feature installed to be able to use this script.  To enable this, run Add/Remove Programs on workstations and Add Web Server Role Services on server operating systems and select the IIS 6.0 Management Compatibility feature under the “Internet Information Services” feature area. If this feature is already installed, please ensure that you are running the script with Administrator privileges.

Summary

We will post more information as our investigations continue, and we will post security advisory updates if the situation changes.  You can learn more about this vulnerability from:

Please post specific questions about the vulnerability in this forum on the www.asp.net web-site.

Thanks,

Scott