Server: Microsoft-IIS/7.0\r\n : IIS KBs

Security Alerts - December 2009

qbernard — Fri, 11 Dec 2009 03:36:00 GMT

Recently, Microsoft released the December security bulletin , and one of the patches related to IIS. Meant to blog about this earlier but Nazim from IIS team beat me to it :) Been seeing lot of discussions online and patch management related mailing list...(read more)

Token Kidnapping - Fixed

qbernard — Tue, 14 Apr 2009 14:09:00 GMT

A year ago... Cesar Cerrudo presented a serious vulnerability via evalvation of privilege involving the NetworkService or LocalService account specific to IIS worker process. Although Microsoft addressed this in April last year, but it was more towards...(read more)

IIS KBs - June 2008

qbernard — Wed, 30 Jul 2008 06:10:00 GMT

950573 FIX: Application domains restart unexpectedly in Internet Information Services 7.0 954874 IIS binds to all IP addresses on a server when you install IIS 7.0 on Windows Server 2008 954872 How to create and manage configuration backups in Internet...(read more)

IIS KBs - May 2008

qbernard — Wed, 11 Jun 2008 10:54:00 GMT

Well, for last month we got zero new IIS KB articles, yet few are related to IIS in certain way.

941850 When you try to access files on a WebDAV site that uses only Digest authentication, the process may fail on a Windows Vista-based computer
942039 FIX: Visual Studio 2005 incorrectly creates a subfolder and moves a Web project to the newly created folder

IIS KBs - April 2008

qbernard — Mon, 26 May 2008 05:15:00 GMT

949516 Error message when you use the "IMSAdminBase::CopyKey" method as a part of the IIS 6.0 Compatibility components in IIS 7.0: "Exception from HRESULT: 0x80070003"
950735 Error message when you use the Configure Web Synchronization Wizard to configure the virtual directory against a server that is running IIS 7.0: "IIS was not found on the Web Server. Please specify a computer name that has IIS installed"

IIS KBs - March 2008

qbernard — Tue, 22 Apr 2008 16:30:00 GMT

948801 If an SMTP connector set the Outbound Security option to "Integrated Windows Authentication," the SMTP connector does not work in the IIS Metabase when you restore an Exchange Server 2003 server by using a Disaster Recovery mode
949455 System Center Operations Manager 2007 Reporting installation fails on a Windows Server 2008 computer if IIS 6.0 Management Compatibility is not installed

IIS KBs - February 2008

qbernard — Tue, 18 Mar 2008 06:34:00 GMT

949348 How to specify a custom location for the isolated configuration file in Internet Information Services 7.0
949349 Error message when you use Server Manager in IIS 7.0 to open a feature configuration page: "Cannot add duplicate collection entry"
949353 The Managed Pipeline Mode setting is not available after you configure an application pool to use the .NET Framework 1.1 in IIS 7.0
949350 You receive an HTTP 500 error message or a blank page appears when you request an ASP.NET resource or WCF resource that is hosted on a server that is running IIS 7.0
949351 You may receive an error message when you use an ASP.NET feature configuration page in IIS 7.0
949076 Opera browsers may crash if they use TLS to connect to an IIS 7.0 Web server that is running Windows Vista or Windows Server 2008

IIS KBs - January 2008

qbernard — Fri, 15 Feb 2008 02:22:00 GMT

946086 ISAPI extensions that send long responses to the client may not transmit any output in Internet Information Services 7.0 until the session is closed
946517 FIX: You may be unable to manage IIS 6.0 by using Server Manager if two threads access IIS 6.0 at the same time

IIS KBs - December 2007

qbernard — Tue, 15 Jan 2008 00:53:00 GMT

Well, nothing much last month due to holiday season. Been very lazy as well :) things are slowly settle down for IIS 7 as w2k8 is going to debut soon. hopefully by Feb or March. Anyway, here's the KB list.

946139 You cannot resolve the built-in IIS accounts after you set a Windows Server 2008-based server that is running IIS 7.0 as a domain controller

IIS KBs - November 2007

qbernard — Wed, 12 Dec 2007 04:31:00 GMT

As W2k8 going RC1, Microsoft published more IIS 7.0 related KBs. November KBs are more related to info update regarding capability such as URLSCAN in IIS 7.0 which is replaced by request filtering module, conslidated IIS 7.0 HTTP status code, etc. As for me, been very busy with work, just got back from US yesterday, still jetlag'ing...working hard to finish my chapters for IIS 7.0 resource kit book with MSPress and going holiday this weekend :)

Anyway, here's the Nov KB list for IIS.
944886 Error message when you use the Response.BinaryWrite method in IIS 6 and in IIS 7: "HTTP 500" or "Response buffer limit exceeded"
944885 Information about the configuration of cluster resources in Internet Information Services 7.0
943891 The HTTP status codes in IIS 7.0
944836 Information about the UrlScan 2.5 features that are included in IIS 7.0
944884 Description of the time-taken field in IIS 6.0 and IIS 7.0 HTTP logging

IIS KBs - October 2007 (More IIS 7 Status Code)

qbernard — Wed, 14 Nov 2007 02:51:00 GMT

942067 Error message when you try to run a Web application that is hosted on a server that is running IIS 7.0: "HTTP Error 403.7 - Forbidden"
942057 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 502.2 – Bad Gateway"
942032 Error message when users visit a Web site that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 404.3 - Not Found"
942036 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.2 - Forbidden"
942053 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.5 – URL Sequence Denied"
942065 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.1 - Forbidden"
942061 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.16 - Forbidden"
942077 Error message when you visit a Web site that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 404.10 - REQUEST_HEADER_TOO_LONG"
942076 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.11 – URL_DOUBLE_ESCAPED"
942038 Error message when you try to visit a Web page that is hosted on Internet Information Services 7.0: "HTTP Error 403.17 (Forbidden) - The client certificate has expired"
942040 Error message when you try to visit a Web page that is hosted on IIS 7.0: "HTTP Error 404.2 – Not Found"
942050 Error message when you visit a Web site that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 406 - Not Acceptable"
942055 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 500.19 – Internal Server Error"
942059 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 502.1 – Bad Gateway"
942063 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.13 - Forbidden"
942074 Error message when you visit a Web site that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 404.13 - CONTENT_LENGTH_TOO_LARGE"
942079 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 401.4 – Authorization failed by filter"
942078 Error message when you visit a Web site that is hosted on a computer that is running IIS 7.0: "HTTP Error 401.5 – Authorization failed by ISAPI/CGI application"
942051 Error message when a user visits a Web site that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 405.0 - Method not allowed"
942071 Error message when you visit a Web site that is hosted on a server that is running IIS 7.0: "HTTP Error 404.15 – Not Found"
942034 You are not prompted to select a client certificate from the local certificate store in IIS 7.0
943240 FIX: Error message when IIS 6.0 receives the entity body for an HTTP POST request while an application pool is recycled: "The underlying connection was closed"

IIS KBs - September 2007 (New IIS 7 Status Code)

qbernard — Mon, 08 Oct 2007 04:52:00 GMT

After a month of silent :) where no new KBs for IIS in previous month. September KB updates bring you lot of new status code in IIS 7.0, covering more detail than I previously posted. Here's the KB list for Sep 2007.

942037 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.18 – Forbidden"
942052 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.4 - Not Found"
942030 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 500.15 – Direct request for global.asa are not allowed"
942035 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.3 – Forbidden"
942048 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.19 - Forbidden"
942075 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.12 – URL_HAS_HIGH_BIT_CHARS"
942069 Error message when you try to browse a Web page that is hosted on IIS 7.0: "HTTP Error 403.5 - Forbidden"
942070 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.4 - Forbidden"
942047 Error message when you try to visit a Web page that is hosted on IIS 7.0: "HTTP Error 404.8 – HIDDEN_NAMESPACE"
942043 Error message when you try to visit a Web page that is hosted on IIS 7.0: "HTTP Error 401.2 - Unauthorized"
942062 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.14 - Forbidden"
942045 Error message when you try to browse a Web page that is hosted on IIS 7.0: "HTTP Error 404.7 – FILE_EXTENSION_DENIED"
942041 Error message when you try to open a Web page that is hosted on IIS 7.0: "HTTP Error 404.0 - Not Found"
942044 Error message when you try to run a Web application that is hosted on IIS 7.0: "HTTP Error 401.1 - Not Found"
942058 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 501.0 – Not Implemented"
942056 Error message when you visit a Web site that is hosted on Internet Information Services (IIS) 7.0: "HTTP Error 412 – Precondition failed"
942064 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.12 - Client Certificate Denied"
942073 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.14 – URL_TOO_LONG"
942031 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 500.0 – Internal Server Error"
942060 Make sure that IIS 7.0 configuration files contain no encrypted properties before you use the Sysprep tool to deploy a Windows Vista image
942068 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.6 - IP Address Rejected"
942042 Error message when you try to browse a Web page that is hosted on a server that is running IIS 7.0: "HTTP Error 401.3 - Unauthorized"
942046 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.6 – VERB_DENIED"
942066 Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.8 - Forbidden"
942049 Error message when you try to visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.9 – File Attribute Hidden"
942858 BUG: Error message when you try to upload a file from a Windows Vista client to a server that is running IIS 6.0: "Cannot read from source file or disk"
942054 Error message when you use a certain method in an MCF Web application that is hosted on IIS: "Value does not fall within the expected range"
942029 Error message when you try to use the Exchange Server ActiveSync Web Administration tool to delete a partnership or to perform a Remote Wipe operation in Exchange Server 2003 Service Pack 2: "(401) Unauthorized"

IIS KBs - July 2007

qbernard — Mon, 13 Aug 2007 23:46:00 GMT

937687 Web clients cannot resume SSL sessions or TLS sessions with IIS 6.0
939573 FIX: Error message in Internet Information Services 6.0 when you use the Active Directory Service Interfaces to enumerate the metabase properties of a virtual directory: "Error 0x80005008"

IIS KBs - June 2007

qbernard — Tue, 10 Jul 2007 04:57:00 GMT

930451 FIX: Internet Information Services 7.0 removes custom values in the Web.config file
938418 Basic authentication does not support using UTF-8-encoded characters in IIS 6.0
937690 You may experience unexpected behavior when you send a request for a resource that has the .map file name extension to a server that is running IIS
937688 Host header names that contain an underscore character are not supported in IIS 7.0
937692 A "Connection_Dropped" event message is logged in the Httperr.log file on a Windows Server 2003-based computer that is running IIS 6.0
937691 How to redirect all requests for a Web site to a page that exists within the Web site in IIS 6.0
937693 Error message when you try to use the Password Change pages that are included with IIS 6.0 to change a domain password that is expired: "Error: Object required"
936476 Error message when a Web application that is hosted on a server that is running Internet Information Services 6.0 requests an ASP page: "HTTP 500 - Internal Server Error"

IIS KBs - May 2007

qbernard — Mon, 25 Jun 2007 01:55:00 GMT

936696 How to enable the metabase auditing feature in IIS 6.0 on a computer that is running Windows Server 2003 Service Pack 1
932385 Changes that are made to Virtual Server Web site properties are not saved on a Windows Vista-based computer
936496 Description of the default settings for the MimeMap property and for the ScriptMaps property in IIS
933216 FIX: The Inetinfo.exe process may stop responding when a file on an FTP site is changed in IIS 6.0

IIS KBs - April 2007

qbernard — Wed, 16 May 2007 06:33:00 GMT

933844 Error message when you try to view a Web page that is hosted on IIS 6.0: "Page cannot be displayed"
934903 FIX: The Session_OnEnd() event is not raised in ASP Web applications as expected after you install Windows Server 2003 with Service Pack 2
935469 FIX: The IP address or the host header of the server that is running IIS may be returned unexpectedly when you use the Request.ServerVariables collection together with the SERVER_NAME parameter in IIS 6

FIX: ASP Session_OnEnd issue with W2k3 SP2

qbernard — Sat, 14 Apr 2007 04:53:00 GMT

If you are encountering ASP Session _OnEnd() issue after installing Service Pack 2 for Windows Server 2003, you can contact Microsoft for the hotfix. Refer
FIX: The Session_OnEnd() event is not raised in ASP Web applications as expected after you install Windows Server 2003 with Service Pack 2
http://support.microsoft.com/?id=934903

And hotfix is free, just ring up Microsoft PSS and provide your detail.

IIS KBs - March 2007

qbernard — Wed, 04 Apr 2007 08:06:00 GMT

927672 Server activation fails when you use a SOAP WSDL moniker to activate a COM+ SOAP-enabled server on a computer that is running Windows Vista
932909 By default, the maximum stack size of a thread that is created in a native IIS process is 256 KB
933343 The Web browser may stop responding when you try to view a Web page that is hosted in IIS 6.0 on a computer that is running an x64-based version of Windows Server 2003
922724 The IISSync command does not run successfully when you use SSL and server certificates in an IIS 5.0 cluster
928452 FIX: In IIS 6.0, Script Debugger breaks on an incorrect line of code when you debug an ASP page that contains double-byte characters
931490 FIX: The Http.sys file does not include the Cache Control: max-age header when the Http.sys file sends an HTTP 304 response in IIS 6.0
934515 You receive an error message when you try to view a Web page from a Web site that uses pass-through authentication in Internet Information Services 7.0

IIS KBs - February 2007

qbernard — Wed, 07 Mar 2007 07:34:00 GMT

929650 How to use SPNs when you configure Web applications that are hosted on IIS 6.0
932448 Error message when you try to log on to an FTP site that is running IIS 6.0: "Error: 530 User <UserName> cannot log in, home directory inaccessible"
932729 FIX: Error message when you try to access a Web site that is hosted on IIS 6.0: Access Denied

IIS KBs - January 2007

qbernard — Fri, 09 Feb 2007 08:23:00 GMT

All new IIS 7 on Vista KBs :)

930907 List of registry keys that are migrated when you upgrade from IIS 5.1 on Windows XP to IIS 7.0 on Windows Vista
931199 The URLScan tool and some ISAPI filters do not work correctly after you upgrade to Windows Vista and Internet Information Services 7.0
930908 You cannot view Web pages that are hosted on a Web server that you upgraded from Windows XP SP2 to Windows Vista, and you receive an HTTP 404 error message
931207 You cannot visit an Internet Information Services 7.0 Web site from a local computer
930909 How to use the Appcmd.exe command-line tool to enable and configure HTTP logging and other features in Internet Information Services 7.0
931197 IIS 7.0 does not return the directory list if you enter an FTP LIST command together with a file mask argument
931204 Error message when you complete a certificate request in Internet Information Services 7.0: "Cannot find the certificate request associated with this certificate file"
930912 All ASP.NET applications run in the same worker process after you upgrade a Windows XP-based computer that is running IIS 5.1 to Windows Vista
931205 How the Internet Server API filter notification process has changed in Internet Information Services 7.0
931206 Error message when you try to install version 2.5 of the UrlScan tool on a computer that is running Internet Information Services 7.0: "Installer cannot install UrlScan because IIS version 4.0, 5.0, 5.1, or 6.0 is not installed on this computer"
931198 Error message when you try to visit a Web page that is hosted on a computer that is running Internet Information Services 7.0: "HTTP Error 503. The service is unavailable"
931208 How to create a log file that can help troubleshoot IIS Admin Base Objects (ABO) Mapper errors in Microsoft Internet Information Services 7.0
930911 The Windows Process Activation Service feature is not turned off when you turn off the IIS 7.0 feature
931209 The exit message of an Internet Information Services 7.0 FTP site is truncated to only 1,017 characters
931203 Internet Server API authentication filters that were created for earlier versions of Internet Information Services do not work correctly in Internet Information Services 7.0
931202 The requirements for using the ODBC logging feature in Internet Information Services
931200 ASP.NET Trace Provider information is removed from the applicationHost.config file after you install Active Server Pages on a Windows Vista-based computer