IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long complex URL that appears to contain a large number of file extensions aka the \Malformed Extension Data in URL\ vulnerability.