Microsoft confirmed yesterday that there is a bug in the company’s web server IIS 6. According to the Microsoft security risk is minimal since it requires that the server is configured in a special way for the security hole to be exploited.
In a security bulletin that Microsoft released yesterday shows examples of the type of configuration that is at risk. The company is working on developing an update that plugs the security hole. The problem affects version 5, 5.1 and 6.0 of IIS. IIS 7 and later are not affected.
According to Eric Schultze at Shavlik security company so they can using any of the affected versions are easy to fix the safety problem itself by install two freeware available to download from Microsoft. The two programs are the IIS Lock Down Tool and the URLScan Tool.
