Late last night the Microsoft Security Response Center sent out notification that they would be releasing an out of band update for the recently revealed vulnerability in ASP.NET that was discussed in Security Advisory 2659883.
The bulletin has a severity rating of Critical and addresses a publicly disclosed vulnerability in ASP.NET that affects all versions of the .NET Framework. While we’re currently unaware of any attacks targeting ASP.NET, we encourage all customers to test and deploy the update when it is available.
An out of band update simply indicates that this update is going to be released outside of the normal release schedule for Microsoft security related updates which is normally the second Tuesday of each month. An out of band update also would indicate that Microsoft is concerned about this vulnerability being exploited in the short term and therefore wants to get the update out to Windows systems world wide very quickly.
According to the MSRC, the update will be available at 10 AM PST and you can check out this chart for your local time when the update should be available.
The team will also host a special webcast to answer questions about this update later today, 29 December 2011, at 1 PM PST. You can register on this website.
