IIS FTP Server Does Not Use Continuation Character Correctly (154962)

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx

SYMPTOMS

The FTP service in Internet Information Server versions 1.0 and 2.0 with directory annotation enabled uses a space for a continuation character in a multi-line response rather than a minus sign (-) as per RFC 959.

Notice the correct behavior below with the Microsoft Windows NT FTP Server. The 230 line is followed immediately by the continuation character (-):

230------------------------------------------------------------------------

and here with the IIS FTP Server it is incorrect

230 -----------------------------------------------------------------------

This can create problems for auto connecting ftp clients.

STATUS

Microsoft has confirmed this to be a problem in Microsoft Internet Information Server versions 1.0 and 2.0. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.

MORE INFORMATION

According to J. Postel & J. Reynolds, RFC 959 - File Transfer Protocol (1985), page 35:

"Thus the format for multi-line replies is that the first line will begin with the exact required reply code, followed immediately by a Hyphen, "-" (also known as Minus), followed by text. The last line will begin with the same code, followed immediately by Space <SP>, optionally some text, and the Telnet end-of-line code."