lextm, I posed your question to the people assisting me with trying to resolve the problem and they said: (actual site names and IP addresses have been obscurred for security purposes)
----------Response-------------------
I can confirm that this particular hotfix was integrated into SP2. In addition to this I have also confirmed that the proper IIS metabase values have been set as follows for site ID '45' or '*my.site.com*'. They are as follows:
ID: 2154
Name: SetHostName
Data Type: String
Data: my.site.com
After doing a bit more research and speaking to other senior level techs I can confirm this is an expected action that is by design. You can see why in the same article that you have referenced from MSDN.com.
http://blogs.msdn.com/asiatech/archive/2009/03/13/why-private-ip-address-is-still-leaked-on-iis-server-even-after-applying-fix-834141.aspx
<snip>
if an HTTP request that does not include an HTTP:Host header value is sent to IIS, and there is an ISAPI filter configured in IIS that makes a call to GetServerVariables(servername) during the SF_NOTIFY_PREPROC_HEADERS event, the IP address will always be returned instead of the server's hostname (or the value set in SetHostName). This is because PREPROC_HEADERS is called before IIS has read the configuration data (in this case either UseHostName or SetHostName), therefore there is no other choice but to return the IP address. This behavior only occurs if the HTTP request doesn't send an HTTP:Host header value; if the request contains a Host value, then SERVER_NAME will contain the value of the client's Host header.
<snip>
Since your telnet request does not include the HTTP:Host header value as expected it has not choice but to return the only IP address it knows, the private IP address. Since this is all done before the metabase.xml is ever read in you can not specify any HTTP errors.
To resolve the problem you can reconfigure your environment to a no-NAT configuration.
Alternatively, that same article mentions
<SNIP>
write an ISAPI filter that blocks and rejects any incoming HTTP requests that do not include an HTTP:Host header.
<SNIP>
------------------------------------------
So while a hotfix was not applied, SP2 is supposed to have what the hotfix would have done. I don't fully understand the part above that talks about the ISAPI filter that calls GetServerVariables.
I am running ASP and I DO have ASP.NET installed, but I'm not currently using it for anything specific, so if I thought it would help resolve the issue I could uninstall ASP.NET
What seems kind of funny to me is our support team says above that KB 834141 does not work. (unless you include the host name. But if I'm a determined attacker, I'm going to use whatever technique works and not use proper protocol).