ASP.Net 2.0 Information Disclosure bug…

I was just thinking about one of the bugs listed in the latest hotfix from MS and realized that while aspx and config files are not at risk since they are mapped to aspnet, the express database if stored in App_Data probably is.


We don’t typically use SQL Express, but my bet is that this is the greatest risk factor for this bug.  Thoughts?