From the developer: "If an IIS server receives a file request that contains a specialized header as well as one of several particular characters at the end, the expected ISAPI extension processing may not occur. The result is that the source code of the file would be sent to the browser.
"It is important to note that normal security recommendations militate strongly against ever including sensitive information in .ASP files and, if these recommendations have been followed, there would be no sensitive information to compromise. The specialized header at issue here cannot be created via a standard Internet browser, so the request would need to be created by an alternate method."
Microsoft has released this patch, which eliminates the security vulnerability.
Requirements:
Windows 2000, Internet Information Services 5
Comments not found