On Premises Customer Security Vulnerability with Telerik UI for ASP.NET

This is a note of a critical security issue found in some of the libraries Bamboo uses with its on premises products. This does not affect SharePoint Online/Microsoft 365 customers.

Bamboo uses a standard .NET library to support the User Interface (UI) experience for its products that is developed by Telerik (Telerik .NET Components Suites & UI Libraries)

Telerik noted a security vulnerability as follows: “A vulnerability in Telerik UI for ASP.NET could allow for arbitrary code execution. ASP.NET is an open-source server-side web-application framework designed for web development to produce dynamic web pages.” Details of the security flaw can be found here: A Vulnerability in Telerik UI for ASP.NET Could Allow for Arbitrary Code Execution (cisecurity.org)

Since most of our customers are in closed SharePoint services and not accessible to the outside world, we did not address this security issue at first.  However, Security teams for our customers have required us to move off this version of Telerik to a version that does not have this vulnerability.

Bamboo has created a hot fix for its products that is available at no charge for customers on active support.

Process for customer to obtain the hotfix

  • Open a support ticket through this link: Submit a request – Bamboo Solutions Knowledge Base (zendesk.com)
  • Support will work with you to identify all servers that require the hot fix.
  • We can only deploy the hot fix to servers running Bamboo products.
  • Servers receiving the hot fix must be properly licensed and on support.
  • Support will provide the hotfix and simple instructions for its deployment to each server.

Once deployed, Bamboo products will be updated and using Telerik Version 2021.1.330.45

Please reach out to support if you have any questions or concerns on this matter.

SharePoint Online

The cloud parts are functional components that extend your SharePoint Online environment in Microsoft 365.

Supports Classic and Modern sites for SharePoint Online/Microsoft 365

SharePoint

Top SharePoint Online Products

Experience greater power and savings by bundling our SharePoint apps and cloud parts.


Calendar Plus


Chart Plus


Knowledge Base


Project Management Central


Simple List Search

 

On-Premises Only

These web parts extend SharePoint beyond its out-of-the-box capabilities by tailoring it to your requirements with Bamboo Solution’s growing portfolio of SharePoint Web Parts.

SharePoint 2013, 2016, 2019 – Classic Pages Only

SharePoint

Top On-Premises Only Products

Experience greater power and savings by bundling our SharePoint apps and web parts.


Calendar Plus


Data Viewer


Password Change


Password Expiration


Password Reset

 

Our team of Microsoft 365 experts help you get the most out of your Microsoft technology, we have the best Microsoft 365 talent to streamline your organization.

Streamline Your Department

We Have What You Need

Bamboo Solutions

About


Blogs


Webinar & Events


Twitch


Culture & Diversity

 

 

Bamboo Solutions

Tools


Resources


Bamboo Installer