News

Flaw Found in Microsoft Enterprise Firewall

Microsoft's enterprise firewall contains a security hole that attackers could use to cause denial-of-service conditions in internal Domain Name Service servers. The security flaw with Internet Security & Acceleration Server rates as a "moderate" security risk, Microsoft security officials determined.

The security bulletin and patch were posted Wednesday night and are available at www.microsoft.com/technet/security/bulletin/MS03-009.asp.

The bulletin makes clear that the flaw cannot be used to take control of the ISA Server 2000 machine or servers behind the firewall that it protects. The flaw involves a feature of ISA Server that provides application-specific processing of incoming traffic. The feature is designed to protect against invalid URLs that are common to attacks against internal DNS servers.

The flaw involves ISA's DNS intrusion application filter, which improperly handles a specific type of request when scanning incoming DNS requests, the Microsoft bulletin states. An attacker could send a specially malformed request to the ISA Server that is publishing a DNS server. In turn, the attack could result in a denial of service to the published DNS server.

"DNS requests arriving at the ISA Server would be stopped at the firewall, and not passed through to the internal DNS server. All other ISA Server functionality would be unaffected," the bulletin states.

One important mitigating factor is that DNS servers are not published by default -- DNS publishing must be manually enabled in ISA Server.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Expands Azure AD Password Lengths, Adds Conditional Access Controls

    Microsoft announced a couple of Azure Active Directory enhancements this week regarding password lengths and new conditional access controls for IT pros.

  • Attack Surface Analyzer 2.0 Available for Checking Software Installs

    Microsoft this week described Attack Surface Analyzer 2.0, an updated tool for checking software installations that's now built using open source code.

  • What Causes Hyper-V Replication Failures?

    Hyper-V replication failures happen rarely, but their impact can be catastrophic when they do. Know the scenarios that are likely to trigger a replication failure.

  • Microsoft Touts Using HyperClear To Address Intel Processor Woes

    Microsoft is again promoting its HyperClear Hyper-V hypervisor technology as a potential balm for organizations trying to come to grips with Intel's latest speculative execution side-channel attack disclosures.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.