Alert: Microsoft Security Bulletin MS04-039 - Vulnerability in ISA Server 2000 and Proxy Server 2.0 Could Allow Internet Content Spoofing (888258)

From: Russ Cooper (Russ.Cooper_at_TRUSECURE.CA)
Date: 11/09/04

  • Next message: Marc Maiffret: "EEYE: Kerio Personal Firewall Multiple IP Options Denial of Service"
    Date:         Tue, 9 Nov 2004 12:53:56 -0500
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    
    

    Microsoft Security Bulletin MS04-039:
    Vulnerability in ISA Server 2000 and Proxy Server 2.0 Could Allow Internet Content Spoofing (888258)

    Bulletin URL:
    <http://www.microsoft.com/technet/security/bulletin/MS04-039.mspx>

    Version Number: 1.0
    Issued Date: Tuesday, November 09, 2004
    Impact of Vulnerability: Spoofing
    Maximum Severity Rating: Important
    Patch(es) Replaced: None
    Caveats: None

    Tested Software:
    Affected Software:
    ------------------
    * Microsoft Proxy Server 2.0 Service Pack 1
    <http://tinyurl.com/65vb5>
    * Microsoft Internet Security and Acceleration Server 2000 Service Pack 1 and Microsoft Internet Security and Acceleration Server 2000 Service Pack 2 Note The following software programs include Microsoft Internet Security and Acceleration Server 2000 (ISA Server 2000). Customers using these software programs should install the provided ISA Server 2000 security update.
    - Microsoft Small Business Server 2000
    - Microsoft Small Business Server 2003 Premium Edition
    <http://tinyurl.com/59pf4>

    Technical Description:
    ----------------------
    * Spoofing Vulnerability - CAN-2004-0892: This is a spoofing vulnerability that exists in the affected products and that could enable an attacker to spoof trusted Internet content. Users could believe they are accessing trusted Internet content when in reality they are accessing malicious Internet content, for example a malicious Web site. However, an attacker would first have to persuade a user to visit the attacker's site to attempt to exploit this vulnerability.

    This email is sent to NTBugtraq automagically as a service to my subscribers. (v4.01.1664.40858)

    Cheers,
    Russ - Senior Scientist - TruSecure Corporation/NTBugtraq Editor

    --
    Editor's Note: The 43rd Most Powerful Person in Networking says...
    Register today to take the TruSecure ICSA exam by 12/31/04  at
    <http://www.2test.com> ,  use promo code "CT1204" and you will pay just
    $221.25 US Dollars for domestic exam delivery and  $296.25 US Dollars
    for international delivery.
    Visit <https://ticsa.trusecure.com>  for complete details regarding the
    TICSA credential and to take the free sample exam.
    --
    

  • Next message: Marc Maiffret: "EEYE: Kerio Personal Firewall Multiple IP Options Denial of Service"

    Relevant Pages

    • RE: Catchall not working, EXTERNALLY?
      ... Microsoft CSS Online Newsgroup Support ... but we will start using the exchange server fully ... When I open the connection (over internet) to my exchange account, ...
      (microsoft.public.windows.server.sbs)
    • RE: remote access SBS 2003 Inop
      ... Since you know the problem is relate to RRAS (Routing and Remote Access ... On the SBS 2003 Server open the Server Management console. ... Click the "Connect to the Internet" link. ... Microsoft CSS Online Newsgroup Support ...
      (microsoft.public.windows.server.sbs)
    • Re: SBS 2003 (no SP) - file saving over network suddenly very slow
      ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... >> the SBS server box? ... >> Norton Internet Security, Norton System Works, and Norton Anti-Virus etc. ...
      (microsoft.public.windows.server.sbs)
    • RE: Catchall not working, EXTERNALLY?
      ... When I open the connection (over internet) to my exchange account, ... the data is stored on the Exchange server side. ... Microsoft CSS Online Newsgroup Support ...
      (microsoft.public.windows.server.sbs)
    • RE: Loading Web Sites
      ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... Have you installed ISA on the server box? ... Click Internet Protocl, and then click Properties. ...
      (microsoft.public.windows.server.sbs)