Microsoft recently posted an article called “What You Should Know About a Reported Vulnerability in Microsoft ASP.NET.” The article explains the recently announced vulnerability in ASP.NET around Canonicalization. Read the article here.
Microsoft has released an HTTP module that Web site administrators can apply to their Web server that will protect all ASP.NET applications on the server against URL canonicalization problems known to Microsoft as of the publication date. Get the HTTP module here: Microsoft Knowledge Base Article 887289.
If you can't install the module, Microsoft has a code snippet that will fix the problem. Find the code snippets for VB.NET and C# in Microsoft Knowledge Base Article 887459.