Secunia

Cesar Cerrudo has reported a security issue in Microsoft Internet Information Services (IIS), potentially allowing malicious people to gain knowledge of certain details about server side scripts.

The problem is that IIS fails to properly handle a cookie, which only consists of a "=", leaving the cookie parameter name and value empty. This causes IIS to return an error message when an ASP script attempts to access cookie values.

This has been reported to affect all versions of IIS (Internet Information Services / Internet Information Server).

Solution
Production systems should always return custom error pages (see Microsoft Knowledge Base article).

Provided and/or discovered by
Cesar Cerrudo

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area