Connection to IIS and NetScape Sun web servers is via ISAPI and NSAPI.

While the test members are using the remote shell on TestBCS to explore additional weaknesses in an effort to gain privileged access, they discover that the server is susceptible to an ISAPI buffer overflow (another vulnerability in Microsoft's ITS server).

(To be a geek for a moment, it is a buffer overrun in the IDA/IDQ ISAPI filter.) That the vulnerability had such a designation implies that Microsoft was aware of it and had issued a bulletin on the vulnerability in question.