ASP.Net vulnerabillity

I got an email today about
http://www.microsoft.com/security/incident/aspnet.mspx
and
http://support.microsoft.com/?kbid=887459

The KB article implies that the problem is in applications, but the
incident article implies that there's a vulnerability in ASP.Net.  While
adding checks to your web application certainly sounds like a Good Idea,
I don't know if I'd consider that a solution to the problem or just a
"best practice".  (It also seems like IIS should handle that, especially
if you have parent paths turned off.)

Is any more information on this issue available?  Are my IIS servers
which have ASP.Net installed, but only have ASP or static HTML pages on
the site, vulnerable?

--
NTBugtraq Editor's Note:

Want to reply to the person who sent this message? This list is configured such 
that just hitting reply is going to result in the message coming to the list, 
not to the individual who sent the message. This was done to help reduce the 
number of Out of Office messages posters received. So if you want to send a 
reply just to the poster, you'll have to copy their email address out of the 
message and place it in your TO: field.
--