Re: Blocking .EXE

From: Tom Kaminski [MVP] ((A_at_T))
Date: 06/30/03


Date: Mon, 30 Jun 2003 11:47:46 -0400


"Dave" <dlbrum@ufl.edu> wrote in message
news:007b01c33f17$bba36070$a101280a@phx.gbl...
> I get a 404, file not found, when browsing a .exe file on
> an IIS 6 win2k3 site: IIS5 executed it fine.
>
> URLSCAN not installed, though this behavior is the same as
> an earlier post (June20) referred.
>
> If I set the folder perms to "scripts only" then I get the
> dialog box asking if I want to download the .exe or .dll
> file. So, the behavior seen is as-if I were running
> URLSCAN and it was blocking with a 404 message.
>
> Does IIS 6 have URLSCAN built-in or ????

Yes it does. I think you need to allow the mime-type to be served.
http://support.microsoft.com/default.aspx?scid=kb;en-us;326965

-- 
Tom Kaminski IIS MVP
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserver2003/community/centers/iis/


Relevant Pages

  • Re: Changing default header
    ... There are other things your IIS server does to leak the version and OS, ... >> running IIS, and a worm or a script kiddie isn't likely to care or check ... >>> Supposedly you can do it with URLScan, but I'd like to remove this ... >>> Greg Kelley ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS port scan messages
    ... those header is just for FUN. ... urlscan is just a MORE user friendly tool to help strenghten security only. ... > Note that this is not likely to fool all attackers. ... > running IIS. ...
    (microsoft.public.inetserver.iis.security)