In light of the IIS 5 ISAPI Extension bug, a Microsoft spokesperson contacted BetaNews with a detailed briefing of the company's response. The flaw, which affects only customers running IIS5, is considered to be a serious threat since the software's default configuration leaves users open to attack. Microsoft has utilized many avenues to inform customers of the importance of applying the security patch. The release of the second Service Pack for Windows 2000 has also been delayed in order to incorporate this latest fix.

By sending a unique string of characters to an IIS 5 machine with Internet Printing enabled, a malicious user can gain full access to a Web server. The printing service module is installed by default. Microsoft informed BetaNews, "IIS 5.0 customers are not at risk if they have removed the Internet Printing capability from their servers. The IIS 5.0 security checklist recommends that this be done, and the security template provided in the checklist removes it. Likewise, the IIS 5.0 Lockdown Tool removes the capability unless the user explicitly chooses to retain it."