FIX: ": $DATA" Data Stream name of a file may return the script code for the file (188806)

WORKAROUND

Note The hotfix for a bug in W3 and in FTP Performance Monitor also fixes the problem that is described in this article. If you plan to use Performance Monitor, see the following article in the Microsoft Knowledge Base:If you cannot apply the available hotfix, you can use the following workarounds to temporarily address this issue.

IIS

Typically, Web users do not have to have Read permissions to script files, such as .asp files. Web users only have to have Execute permissions. Removing Read permissions to these files for non-administrative users addresses this exposure.

Make the following additions to the Application Map in IIS 4.0. You must do this for all mappings.

1. Open the Microsoft Management Console (MMC).
2. Right-click the virtual server in question.
3. Click Properties.
4. On the Home Directory tab, click Configuration.
5. Add each entries that follows to the list of application mappings. The entries must be entered in the file name extension.
   
   Executable Path %System32%\Inetsrv\Asp.dll

         .asp::$DATA
         .asa::$DATA
   
   						

   Executable Path %System32%\Inetsrv\Ssinc.dll

         .stm::$DATA
         .shtm::$DATA
         .shtml::$DATA
   
   						

   Executable Path %System32%\Inetsrv\Httpodbc.dll

         .idc::$DATA
   
   						

   Executable Path %System32%\Webhits.dll

         .htw::$DATA
   
   						

   If you use Index Server, also include the following:
   
   Executable Path %System32%\Idq.dll

         .idq::$DATA
         .ida::$DATA
   
   						

   PERL
   
   If you use PERL, add the following entry. Make sure that the following entry is mapped to your PERL script interpreter:

         .pl::$DATA
   
   						

General security practices

Additionally, the following practices may help enhance security for your servers that are running IIS:

• Periodically review the users and the groups who have access to the Web server. Review the users and the groups and their permissions to make sure that only valid users have the appropriate permissions.
• Use auditing to detect suspicious activity. Apply auditing controls to sensitive log files and then review these log files periodically to detect suspicious behavior or unauthorized behavior.
• Set Read permissions and Execute permissions appropriately. ASP files and other script files do not have to be readable by users who access ASP files and other script files through IIS. Instead, ASP files and other script files have to be executable. Therefore, remove Read permissions from these files for typical users.