Microsoft wasn't downplaying the threat to Web sites and applications. "The publicly disclosed exploit can be used against all types of ASP.NET applications," Guthrie said in a FAQ he posted Monday.
"All sites that use ASP.NET are affected by this vulnerability," echoed Kevin Brown, an engineer with the Microsoft Security Response Center.
The MSRC also took its usual shot at researchers who publicly disclose bugs in its products before a patch is ready. In an entry to the group's blog , spokesman Dave Forstrom cited "coordinated vulnerability disclosure," a term Microsoft coined last summer to describe how it wants outside researchers to behave.
"We fundamentally believe, and history has shown, that once vulnerability details are released publicly, the probability of exploitation rises significantly," Forstrom said. "Without coordination in place to provide a security update or proper guidance, risk to customers is greatly amplified."
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com .
Read more about security in Computerworld's Security Topic Center.