What products are affected by the vulnerability?
The vulnerability lies in IIS 4.0. However, several other Microsoft products use IIS 4.0 as their web engine and are therefore also affected. These include Microsoft Site Server 3.0; Microsoft Site Server 3.0, Commerce Edition; and Microsoft Commercial Internet System 2.0 and 2.5. If you have any of these products, you should consider applying the patch.