IIS Reveals Source Code - 21 Dec 1999

IIS Reveals Source Code

Reported December 22, 1999 by
Adam Hunger

Internet Information Server 4.0
  • Site Server 3.0
  • Site Server Commerce 3.0


    According to Microsoft"s bulletin, "If a file on one of the affected web server products resides in a virtual directory whose name contains a legal file extension, the normal server-side processing of the file can be bypassed. The vulnerability would manifest itself in different ways depending on the specific file type requested, the specific file extension in the virtual directory name, and the permissions that the requester has in the directory. In most cases, an error would result and the requested file would not be served. In the worse case, the source code of .ASP or other files could be sent to the browser.

    This vulnerability would be most likely to occur due to administrator error, or if a product generated an affected virtual directory name by default. (Front Page Server Extensions is one such product). Recommended security practices militate against including sensitive information in .ASP and other files that require server-side processing, and if this recommendation is observed, there would be no sensitive information divulged even if this vulnerability occurred. In any event, an affected virtual directory could be identified during routine testing of the server.


    Microsoft released a FAQ, Support Online articles Q238606, and Q186803, as well as patches for Intel and Alpha that correct the issue.

    Discovered by
    Adam Hunger

  • Hide comments


    • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

    Plain text

    • No HTML tags allowed.
    • Web page addresses and e-mail addresses turn into links automatically.
    • Lines and paragraphs break automatically.