IIS5 File-Fragment Reading via Malformed HTR Request Vulnerability Patch for Windows

Name: IIS5 File-Fragment Reading via Malformed HTR Request Vulnerability Patch
Rating: 5 (1 reviews)
Author: Microsoft

Download now

Used IIS5 File-Fragment Reading via Malformed HTR Request Vulnerability Patch for Windows?

Developer’s Description

By Microsoft

Stop malicious users from controlling your Web server.

This vulnerability involves a new variant of the 'File Fragment Reading via .HTR' vulnerability, previous variants of which were discussed in Microsoft Security Bulletins MS00-031 and MS00-044. Like the original variants, this one could enable an attacker to request a file in a way that would cause it to be processed by the HTR ISAPI extension. The result of doing this is that fragments of server-side files, such as ASP files, could potentially be sent to the attacker.

Customers who have previously disabled the HTR functionality would not be affected by this vulnerability. Microsoft recommends that all customers who haven't already disabled HTR do so, unless there is a business-critical reason for keeping it. For the latter group of customers, this patch will eliminate this vulnerability.