IIS Reveals Source Code
Reported December 22, 1999 by Adam Hunger
According to Microsoft"s bulletin, "If a file on one of the affected web server products resides in a virtual directory whose name contains a legal file extension, the normal server-side processing of the file can be bypassed. The vulnerability would manifest itself in different ways depending on the specific file type requested, the specific file extension in the virtual directory name, and the permissions that the requester has in the directory. In most cases, an error would result and the requested file would not be served. In the worse case, the source code of .ASP or other files could be sent to the browser.
Discovered by Adam Hunger