It gives attackers a way to view protected files on the server without authorization and it could be used to upload files as well, according to Thierry Zoller, an independent security researcher who Rangos' findings. However, Zoller said he had found no way to use this flaw to run unauthorized software on an IIS server.

Zoller said that IIS 5 and IIS 7 do not appear to be vulnerable to the attack, but that it could affect other Microsoft products that use the WebDAV technology. "Better safe than sorry," he said via instant message, "Disable WebDAV temporarily and wait for Microsoft to patch."

In an e-mail interview, Rangos said that even with WebDAV enabled, Exchange Server running on IIS 6 and SharePoint Server were not affected by the flaw.

Cisco sounded a similar warning. "Administrators of sites that are hosting sensitive information on IIS servers that use WebDAV are advised to put effective mitigations into place immediately because exploit code is publicly available," the company said in a .