The Cerberus Security Team has found a third issue with Microsoft's Index Server that affects any web site running Internet Information Server 4 or 5 with Index Server even if the recent Index Server patch has been installed and even if no .htw files exist on the file system. These systems are at risk from having the source of ASP pages or other files such as the global.asa being revealed. Full only the HTML a user would normally see is returned. Full it is possible to get the full source. Part of the problem exists because 'null.htw' is not a real file that maps to any file on the file system, rather it is a 'virtual file' held in memory so even if there are no real .htw files on the file system IIS boxes with Index Server will still be at risk.
Any request made to null.htw is dealt with by webhits.dll.
If the functionality provided by webhits is need install Microsoft's patch. If the functionality is not needed, however, simply unmap the .htw extention from webhits.dll using the Internet Service Manager MMC snap-in. This not only keeps the team sharp but also helps the industry and vendors as a whole ultimately protecting the end consumer. As testimony to their ability and expertise one just has to look at exactly how many major vulnerabilities have been discovered by the Cerberus Security Team - over 40 to date, making them a clear leader of companies offering such security services. Founded in late 1999, by Mark and David Litchfield, Cerberus Information Security, Ltd are located in London, UK but serves customers across the World.