Inge Henriksen has discovered a vulnerability in Microsoft Internet Information Services (IIS), which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the Internet Information Services 5.1 URL parser and can be exploited via a specially crafted URL request.

Example:
http://[host]/[dir]/.dll/%01~0

Successful exploitation requires that "[dir]" is a virtual directory configured with "Scripts & Executables" execution permissions.

NOTE: IIS will automatically restart after a crash.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Originally reported as a DoS by Inge Henriksen.

Additional information provided to Microsoft by Watchfire.

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS07-041 (KB939373):
http://www.microsoft.com/technet/security/Bulletin/MS07-041.mspx

Inge Henriksen:
http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html

Deep Links
Links available to Secunia VIM customers