Microsoft confirms IIS bug gives complete server control
First paragraph says much about the problem
In your opening paragraph, you describe IIS as a 'webserver', as if it were a standalone program like Apache. However, although it originally incorporated large chunks of the NSCA server that both it and Apache share a common heritage with, it is actually a bundle of internet-enabled servers that now form part of the core of a Windows Kernel module.
As your article reveals, IIS offers FTP - but it also offers FTPS, Network News protocol and SMTP. There are even said to be stubs of other servers that were either never implemented or have since been disabled, sitting there in memory. The problem, here, is that many sys admins install this kernel module, needing nothing more than the ability to serve up webpages, but never bother to think whether they should, or should not, turn on these other services. I've known many who do not know whether the FTP clients their suers are using, to communicate with their server, support FTPS or FTP, and so turn on both, "just to get the job done". Others believe that it's "best to turn on everything, since you never know when you'll need it".
Couple this attitude with the fact that busting into IIS is actually busting into a part of the operating system kernel and you do have a potential means of causing considerable harm.
