Microsoft warns of firewall vulnerability
Microsoft Corp. warned customers of another security vulnerability on Wednesday, this one affecting its Internet Security and Acceleration (ISA) Server 2000 firewall and Web cache product.
A software flaw was found in the ISA Server's Domain Name Service (DNS) intrusion detection application filter that could allow an attacker to launch a denial of service (DoS) attack against the ISA Server that prevents that device from processing DNS requests.
The ISA Server allows DNS requests to be passed from the Internet to an internal DNS server, a process known as DNS publishing.
Application filters are used to analyze incoming data streams, including DNS requests. The filters enable the ISA Server to block, redirect or modify data as it passes through the firewall. For example, the filters could guard against attacks embedded in Uniform Resource Locators (URLs), Microsoft said.
Because of the flaw, however, a specially formed DNS request, encountered under what Microsoft termed "a specific circumstance," causes the DNS server publishing feature to stop responding. DNS requests received by the ISA Server after the DoS attack would be stopped at the firewall, Microsoft said. While other ISA Server functions would be unaffected by the failure of the DNS publishing component, administrators would need to restart the ISA server to recover from the DoS attack, the company said.
Microsoft rated the ISA Server vulnerability "moderate," saying that it could only be used in a DoS attack and did not offer attackers the ability to disable the firewall or gain administrative control of the ISA Server.
Microsoft provided a patch for the ISA Server vulnerability, MS03-009, at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-009.asp.
The warning was the second such notice released on Wednesday and the third this week from the Redmond, Washington, company.
The other two alerts this week, both rated critical, concerned buffer overflow vulnerabilities in a Windows 2000 component that supports the World Wide Web Distributed Authoring and Versioning (WebDAV) protocol and the Windows Script Engine, which is found in all of the company's supported Windows operating systems.
IDG News Service
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.
