Summary: Microsoft belittles a 0-day IIS flaw that it has confirmed around the time it was discovered

JUST around Christmas it turned out that Microsoft IIS was left vulnerable again. The H wrote about this (as did others) and SoftPedia then claimed: "Microsoft Confirms 0-Day IIS Security Vulnerability"

Microsoft has confirmed officially a zero-day security vulnerability affecting Internet Information Services (IIS). The security hole was initially reported just ahead of Christmas on December 23rd, and the Redmond company provided the first response at the end of the past week

There is a conflicting report saying that Microsoft keeps pretending that it's not a big deal. Microsoft's negligence -- not incompetence -- may merit a lawsuit [1, 2, 3]. ⬆