Severity Rating: Critical - Revision Note: V4.0 (May 7, 2009): Bulletin updated: Added as affected software: Microsoft .NET Framework 1.0 (KB928367) on 32-bit and x64-based editions of Windows Vista Service Pack 2 and on 32-bit editions of Windows Server 2008 Service Pack 2; Microsoft .NET Framework 1.1 (KB929729) on 32-bit and x64-based editions of Windows Vista Service Pack 2 and on 32-bit, x64-based, and Itanium-based editions of Windows Server 2008 Service Pack 2. This is a detection change only; there were no changes to the binaries. Customers who have already successfully installed KB928367 or KB929729 do not need to reinstall.Summary: This update resolves three privately reported vulnerabilities. Two of these vulnerabilities could allow remote code execution on client systems with .NET Framework installed, and one could allow information disclosure on Web servers running ASP.NET. In all remote code execution cases, users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Read more at: http://www.microsoft.com/technet/security/bulletin/MS07-040.mspx?pubDate=2009-05-07