Microsoft KB Archive/311481

= PRB: IIS 6.0: CGI Code That Calls External Applications May Fail =

Article ID: 311481

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Internet Information Services 6.0

-



This article was previously published under Q311481



SYMPTOMS
When you use anonymous authentication and you call external programs (including PHP programs) from Common Gateway Interface (CGI) code, the operation may fail.



CAUSE
In Internet Information Services (IIS) 6.0, the IUSR_< > (anonymous) account does not have the necessary file system permissions to run executable programs in the %windir%\System32 folder by default. This denial can cause CGI code that attempts to run these external programs in the anonymous security context to fail.



RESOLUTION
To resolve this problem, grant the IUSR_< > account (or the specific account that is being used as the anonymous identity) Read and Execute access to any program or command-line tool (such as Cmd.exe) that is necessary for the application to function correctly.



STATUS
This behavior is by design.



Steps to Reproduce Behavior
 Install PHP 4.0 on IIS 6.0. Associate the .php extension in IIS 6.0 with the Php.exe CGI application. To do this, follow these steps:  Open the IIS Manager. Open the property sheet for the Web site to which you want to add the PHP extension. On the Home Directory tab, click Configuration.</li> Under Application Mappings, click Add.</li> For Executable, type the path to Php.exe (for example, C:\Php\Php.exe).</li> For Extension box, type .php and click OK.</li> Save your changes, and then close the IIS Manager.</li></ol> </li>  In Notepad, save the following code as Test.php: <?php $output = `ping localhost`; echo $output; ?> </li> Save the file in the Web site publishing point.</li> Call the file from a Web browser (for example, http:// /test.php).</li></ol>

You should see the problem that is described earlier if the IUSR account is not granted file system access to Ping.exe (located in %windir%\System32).

Note For this code to work, IUSR must have Read and Execute access to Ping.exe.

Additional query words: IIS 6 IIS6 PHP CGI ACL access control list

Keywords: kbprb KB311481

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.