IIS 5.x Custom Error Page Bug :)
In relate to this posting, Microsoft has officially addressed the issue with this kb.
905910 The custom error page 500-100.asp may return sensitive information in Internet Information Services 5.0 and in Internet Information Services 5.1
Just to recap, best practises here are always
- configure host header even though you only have one site with one URL name.
- bind website to specific network interface.