This important update resolves a privately reported vulnerability in Internet
Information Services (IIS). A remote code execution vulnerability exists in the
way that IIS handles input to ASP Web pages. An attacker who successfully
exploited this vulnerability could then perform actions on the IIS server with
the same rights as the Worker Process Identity (WPI). The WPI is configured
with Network Service account privileges by default. IIS servers with ASP pages
whose application pools are configured with a WPI that uses an account with
administrative privileges could be more seriously impacted than IIS servers
whose application pool is configured with the default WPI settings.