In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Internet_information_server | Microsoft | 3.0 (including) | 3.0 (including) |
| Internet_information_server | Microsoft | 4.0 (including) | 4.0 (including) |
| Internet_information_services | Microsoft | 2.0 (including) | 2.0 (including) |