GCVE-110-CERTCC-2001-264272

A vulnerability exists in Microsoft Information Server (IIS) in which a crafted HTTP GET request may return the contents of a file on the affected server. A possible target of such a request might be a script that should only be executable (not readable) by unauthenticated remote users. The contents of such a file might contain sensitive information such as user credentials for access to a back-end database. This is a variation of the vulnerability discussed in VU#35085 and Microsoft Security Bulletin MS00-031 and more recently in VU#28565 and Microsoft Security Bulletin MS00-044.