<A target="_blank" href="http://www.theregister.co.uk/2009/12/30/iis_web_server_bug_rebuttal/">After researchers declared it a bug, Microsoft has responded,</A> "it's not a vulnerability, it's an inconsistency". The problem code is in IIS 6. This article includes a link to a Technet disclaimer.