Crazy ides about .exe isapi mappings

From: Mike Shaw (mshaw@wwisp.com)
Date: 10/17/01 

Message-Id: <5.1.0.14.0.20011017133558.00b1d240@mail.wwisp.com>
Date: Wed, 17 Oct 2001 13:46:04 -0500
To: focus-ms@securityfocus.com
From: Mike Shaw <mshaw@wwisp.com>
Subject: Crazy ides about .exe isapi mappings

In IIS, why not map .exe extensions to a non-existent or otherwise
hamstrung executable map?

This would prevent execution of cmd, net, tftp, etc. from directory
traversal exploits. I don't mean existing ones (where the server should be
patched) I mean the ones we may not know about.

-Mike

Quantcast