Out of Band Security Update for Vulnerability in ASP.NET Being Released Today

Hello,

It would appear that there is an update being shipped for ASP.Net today which will fix a vulnerability which was discussed in Security Advisory 2659883.

You can find more information about this Security Update on this blog post:

http://www.windowsobserver.com/2011/...eleased-today/

EDIT:

Scott Gu has just posted about this as well. You can find that here:

http://weblogs.asp.net/scottgu/archi...-dec-29th.aspx

The release has just been made public:

http://blogs.technet.com/b/msrc/arch...y-2659883.aspx

Gary

A security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated.