Exchange 2000 messages note being delivered to Ent 2004 - asolution with a question

[David Blaymires]

We have been finding that messages that contain some special characters like
%, & and @ do not get delivered to the recipients who are using Entourage
2004 - both the original version and the SP1 version. Messages with those
characters also can not be displayed in Outlook Web Access.

We have been working with a dedicated and determined Entourage guy at MS,
and after much to-ing and fro-ing and getting him online to our server, we
have been able to isolate that it is the IIS Lockdown Tool that has been
applied to the Exchange Server that enables a thing called URLSCAN that is
causing the problem.

The Entourage person at MS tells me this morning that amending the
URLSCAN.ini file and commenting out the following lines:

This is the part of urlscan.ini that is changing the encoding behavior of IIS:

[DenyUrlSequences]
.. ; Don't allow directory traversals
./ ; Don't allow trailing dot on a directory name
\ ; Don't allow backslashes in URL
% ; Don't allow escaping after normalization
& ; Don't allow multiple CGI processes to run on a single request

I commented these out in my test environment and Entourage returned to working
properly. I'm not sure of the bigger security implications of making this
change, but it does appear to be the cause of the Entourage issue.

results in all mail being delivered. However, as you will note from the
quote from the email from MS, the security implications of commenting this
out are unknown.

Is there an Exchange/IIS lurker who can advise what the implications are? I
know that we are not the only ones having this problem, there are many who
are interested in a solution.

I am also going to post this at what I hope is the right Exchange Newsgroup
in the hope that we may get an answer there. Before someone blasts me for
cross-posting, the reason I am cross posting is so someone here will benefit
from knowing that there is a potential solution, but the expertise for the
Exchange side is probably located elsewhere.