Out of Band Security Update for Vulnerability in ASP.NET Being Released Today

[gep13]

Hello,

It would appear that there is an update being shipped for ASP.Net today which will fix a vulnerability which was discussed in Security Advisory 2659883.

You can find more information about this Security Update on this blog post:

http://www.windowsobserver.com/2011/12/29/out-of-band-security-update-for-vulnerability-in-asp-net-being-released-today/

EDIT:

Scott Gu has just posted about this as well. You can find that here:

http://weblogs.asp.net/scottgu/archive/2011/12/28/asp-net-security-update-shipping-thursday-dec-29th.aspx

The release has just been made public:

http://blogs.technet.com/b/msrc/archive/2011/12/29/microsoft-releases-ms11-100-for-security-advisory-2659883.aspx

Gary

 

[shMelbin]

A security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated.