NT Versions Affected:

3.51, 4.0

Problem:

Internet Information Server 1.0 (IIS) allows the use of batch files as CGI applications. Using batch files as CGI applications exposed several security issues in IIS because the batch file processes run in the context of the full Windows NT console command processor (cmd.exe).

Verification:

http://www.microsoft.com/kb/articles/q155/0/56.htm

http://www.microsoft.com/kb/articles/Q148/1/88.htm

http://www.omna.com/iis-bug.htm