Is the ASP.Net Bug a Big Deal? MS Thinks So

I sat up and took notice when Microsoft released not one, but two interim fixes to an announced flaw in ASP.Net, and released them fairly quickly. This is not SOP in Microsoft Land.

The original report actually came out weeks ago and somehow flew under the radar until just the last few days. To be honest, I'm still not sure just how many sites are actually vulnerable, but I take all the attention Microsoft is paying as a sign that it's a large number.
And no surprise there. According to Netcraft's write-up on the bug, there are currently 2.9 million active ASP.Net sites on the Internet. Certainly a large number of those have no authenticated pages and are therefore not vulnerable. Clearly a large number are just developer systems, test sites and default installations with nothing of interest. But just as surely, a large number are critical e-commerce and other such sites, and their privileged pages are vulnerable to unauthorized access.