Microsoft ISA Server 2000 domain request canonicalization...

Date Discovered: April 21, 2003
Date Published: August 1, 2004
Last Updated: August 1, 2004

Vulnerability ID: 28835
Discovered by: vendor
Exploitable Locally: No
Exploitable Remotely: Yes
Impact: Remote attackers can bypass proxy setting to access restricted sites.
Root Cause: Software Vulnerability

Microsoft ISA Server 2000 contains a vulnerability that can allow an attacker to bypass proxy settings and access restricted sites. The vulnerability is due to improper canonicalization when processing domain requests containing the root period. Attackers can exploit the vulnerability to bypass proxy settings to access restricted sites.

Recommendations

Apply the fix provided by the vendor. Note: You must have ISA SP1 installed before you can install this hotfix.

ISA Server:
isahf174.exe
http://www.microsoft.com/downloads/Release.asp?ReleaseID=38362

Vendor advisory:
Microsoft Knowledge Base Article - 321846

ISA Server 2000 SP2 also includes the fix for this issue.

ISA Server 2000 SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=C8D3D98B-1CD4-406A-A04A-2AA2547D09A3&displaylang=en

Affected Technologies

Microsoft: ISA Server 2000 Gold
Microsoft: ISA Server 2000 SP1

References

Mitre CVE: MAP-NOMATCH

More information on CA Virus Information Center:
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=28835

Computer Associates – the Trusted Source of Security Knowledge