This vulnerability could allow a web site viewer to obtain the source code for .asp and
similar files if the server's default language (Input Locale) is set to Chinese, Japanese
or Korean. How this works is as follows:
Request a URL of a known-good file that requires server processing, then append a hex
value between x81 and xfe to the URL. For example:
If your server is vulnerable you will receive back the source code of your .asp file.
IIS checks the extension of the requested file to see if it needs to do any processing
before delivering the information. If the requested extension is not on its list, it
then makes any language-based calculations, and delivers the file. If a single byte is
appended to the end of the URL when IIS to set to use one of the double-byte language
packs (Chinese, Japanese, or Korean) the language module will strip it as invalid, then
look for the file. Since the new URL now points to a valid filename, and IIS has already
determined that this transaction requires no processing, the file is simply delivered
as is, exposing the source code.