Microsoft on Tuesday will release an emergency out-of-band patch for the ASP.NET padding oracle attack that was disclosed earlier this month. The patch will only be available on the company s Download Center for the time being. The company is taking the step of releasing an emergency fix for the bug because of the seriousness of the vulnerability which potentially affects millions of Web applications and the fact that there are attacks ongoing against it already. Microsoft plans to release the patch through Windows Update and Windows Server Update within the next week.
Source: https://threatpost.com/microsoft-release-emergency-patch-aspnet-bug-092710/74520/