Microsoft Fixes ASP.NET Flaw With Out-Of-Band Release

Microsoft (NSDQ:MSFT) released an out-of-band patch Tuesday repairing a publicly disclosed vulnerability in the ASP.Net framework that paved the way for hackers to access and tamper with sensitive, encrypted data stored on an organization's Web server.

The ASP.NET flaw, which was given the slightly less severe ranking of "important," affects all versions of the .NET framework used on Windows Server operating systems, including Windows XP, Windows Vista, Windows 7, Windows Server 2003 and 2008 and Windows Server 2008 R2. However, versions of the .NET Framework prior to 3.5 Service Pack 1 are not affected by the portion of the vulnerability that enable disclosure of file contents, Microsoft said.

Reports indicate that the flaw is already being exploited in 'limited and targeted" attacks in the wild. Microsoft said that Windows desktops systems are also affected, "but consumers are not vulnerable unless they are running a Web server from their computer," said Dave Forstrom, director of Micr