The viewcode.asp sample file in IIS and Site Server allows remote malicious users to read arbitrary files.
microsoft internet information server 4.0