Microsoft Bulletin MS10-070 has been released. An update is now available that addresses the ASP.NET "information disclosure" vulnerability (CVE-2010-3332) that we reported on earlier 

The core pieces in the advisory are probably in the sections that read

"In Microsoft .NET Framework 3.5 Service Pack 1 and above, this vulnerability can be used by an attacker to retrieve the contents of any file within the ASP.NET application, including web.config"   and  "This vulnerability can also be used for data tampering, which, if successfully exploited, could be used to decrypt and tamper with the data encrypted by the server." 

Translated, this means that the vulnerability undermines basic web application security. I suspect that online shops and such might rate the risk that "an attacker can read any file" on their web application server a bit higher than just "important".

According to the bulletin, MSFT are aware of "active attacks".

In combination, this sure sounds like PATCH NOW! to me.

Update 1800UTC: If you're wondering what a "Padding Oracle" is, the original attack is described very well in this research paper .

Update 1830UTC: Changing InfoCon to YELLOW, to raise awareness for this problem and patch. We'll go back to GREEN in 24hrs unless significant new information develops.

Update 00:13 UTC: Changing InfoCon back to Green. Most people should be well and truly aware of the issue. We may raise it again if we receive reports of widespread use or other changes.