I did a ton of ASP.NET stuff in 1.0 and 1.1, and did some prototyping in ASP.NET 2.0, but have been away from the front lines of ASP.NET and IIS for a few years (Since a few months after 2.0 came out, ...

Patching is not enough: applications embedding the insecure library will need to be rebuilt, and affected tokens and cookies expired. Developers are advised to check their applications after Microsoft ...