Technical Information

Brief overview of the risk:
This security update addresses a privately reported Denial of Service vulnerability in the Microsoft .NET Framework component of Microsoft Windows. This vulnerability can be exploited only when Internet Information Services (IIS) 7.0 is installed and ASP.NET is configured to use integrated mode on affected versions of Microsoft Windows.
Detailed Information on the risk:

A Denial of Service vulnerability exists in the way ASP.NET manages request scheduling. An attacker could exploit this vulnerability by creating specially crafted anonymous HTTP requests that would cause the affected Web server to become non-responsive until the associated application pool is restarted.

Further information on this exploit is available at : MS09-036