I have a client that was scanned and determined not to be PCI Compliant. I looked and they had IIS setup to allow a program from central office to push/pull info from their server. Many of the reasons they failed appeared to have been fixed in SPs (they were on SP2) or security updates. I fully patched the server to (Windows XP Pro) SP3 with all optional updates. I had them scan again and again they failed with only one less vulnerability that I manually corrected (server was showing debugging/error messages). The main issue I'm having is that when I research the CVE code for each error, they say they are fixed in SP2 and up. I'm wondering if I need to remove IIS and resetup since I have patched to SP3. Any ideas?
It's been said in comments, but I don't see an answer posted, so I'll say it here:
Use a real Server OS, and a current version of IIS.
Support for IIS 5.0 ended on July 13 2010, so any newly-discovered security vulnerabilities for that version will not be patched. Even if you apply all the available patches, any zero-day exploits developed against IIS 5 will be forever usable against your system unless you upgrade to a newer version.
Similarly, support for Windows XP is (or already has, depending on Service Pack) coming quickly to an end. Microsoft stopped releasing updates for Service Pack 2 at the same time as IIS 5. Support for Service Pack 3 is currently scheduled to expire (and we're not expecting any more extensions this time) on April 8 2014.
The latest version of IIS is 7.5 and can only be run as a part of Server 2008 R2. Support (including security updates) for those products should extent until at least 2018. After (but preferably some time in advance of) that point, you should again upgrade to the latest Service Packs or a newer version - whichever is applicable.