Microsoft Internet Information Server 5.0, with Microsoft Index Server installed has been found to be vulnerable to an exploit that allows unauthorized directory listings to be leaked.
It is important to note that Microsoft Index Server must be installed in order for this exploit to work. As provided by @stake, the following request could allow a malicious user to obtain directory listings from directories that are not normally available;
Microsoft has released a knowledge base article available at; http://www.microsoft.com/technet/support/kb.asp?ID=272079
It is also recommended that if Index Server is required that any sensitive files be stored on directories that are not indexed or have READ permissions removed.