Flaw In ISA Server DNS Intrusion Detection Filter New

A security vulnerability exists in the DNS intrusion detecion filter of Microsoft Internet Security and Acceleration (ISA) Server 2000 which be used by a malicious user to cause a denial of service.

Issue

Microsoft Internet Security and Acceleration (ISA) Server 2000 contains the ability to apply application filters to incoming traffic. Application filters allow ISA Server to analyze a data stream for a particular application and provide application-specific processing including inspecting, screening or blocking, redirecting, or modifying the data as it passes through the firewall. This mechanism is used to protect against invalid URLs which may indicate attempted attacks as well as attacks against internal Domain Name Service (DNS) Servers.

A flaw exists in the ISA Server DNS intrusion detection application filter, and results because the filter does not properly handle a specific type of request when scanning incoming DNS requests.

An attacker could exploit the vulnerability by sending a specially formed request to an ISA Server computer that is publishing a DNS server, which could then result in a denial of service to the published DNS server. DNS requests arriving at the ISA Server would be stopped at the firewall, and not passed through to the internal DNS server. All other ISA Server functionality would be unaffected.

Affected Products

• Microsoft® Internet Security and Acceleration (ISA) Server 2000

Download

Patch: http://microsoft.com/downloads/details.aspx?FamilyId=F62127C5-51E3-4B34-A6D3-B9CF840358BD&displaylang=en

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: March 19, 2003

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<