Microsoft Internet Information Services (IIS) Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Microsoft Information Services (IIS) that is caused when incoming web requests are not properly compared against the "IP and domain restriction" filtering list. Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers. The update addresses the vulnerability by modifying how inbound web requests are compared to the allow/deny list maintained by the "IP and domain restrictions" component.