Please take a close look at the info page about a reported security issue with ASP.NET:
http://www.microsoft.com/security/incident/aspnet.mspx
Brian Goldfarb also started a new thread about it on the ASP.NET Forums:
http://www.asp.net/Forums/ShowPost.aspx?tabindex=1&PostID=711220