Microsoft has released a new security patch for IIS 4.0 and 5.0

This patch is a cumulative patch that includes the functionality of
all security patches released to date for IIS 5.0, and all patches
released for IIS 4.0 since Windows NT(r) 4.0 Service Pack 5. A complete listing of the patches superseded by this patch is provided in the web-hosted security bulletin, in the section titled "Additional information about this patch". Before applying the patch, system administrators should take note of the caveats discussed in the same section.

Download