I just wanted to clarify some issues here. First of all, this is by no means a
new discovery. Others have mentioned it and I even used it as an example in my
book "Hacking the Code". It is not a flaw in the handling of the server
variable, but a bug in the 500-100.asp script. It is also important to note
that this issue does not affect IIS 6 as Inge claims.
The original code in IIS 5 used the SERVER_NAME variable to see if the user was
local with this code:
If (strServername = "localhost" or strServerIP = strRemoteIP)
And .....
In IIS 6 they updated the code to this:
If (strServerIP = strRemoteIP) And...
A quick fix for this is to pull the 500-100.asp script from IIS 6 and use it
for IIS 5. A better fix is to simply replace that error with a static html page.
So if you maintain a vulnerability database, write vulnerability scanners,
assign vulnerability ID numbers, or if you somehow document this, you should
correct this so we all don't have to explain this every time in the next 10
years that someone runs vulnerability scanner on IIS 6 and this shows up in the
report.
Incidently, you do not need to use telnet to manually enter the URL to exploit
this. An easier solution is to change your HOSTS file so that localhost points
to the remote IP address of the target IIS server. Then you can use your
browser to hammer away at it.
Mark Burnett