News

Flaw Found in Microsoft Enterprise Firewall

Microsoft's enterprise firewall contains a security hole that attackers could use to cause denial-of-service conditions in internal Domain Name Service servers. The security flaw with Internet Security & Acceleration Server rates as a "moderate" security risk, Microsoft security officials determined.

The security bulletin and patch were posted Wednesday night and are available at www.microsoft.com/technet/security/bulletin/MS03-009.asp.

The bulletin makes clear that the flaw cannot be used to take control of the ISA Server 2000 machine or servers behind the firewall that it protects. The flaw involves a feature of ISA Server that provides application-specific processing of incoming traffic. The feature is designed to protect against invalid URLs that are common to attacks against internal DNS servers.

The flaw involves ISA's DNS intrusion application filter, which improperly handles a specific type of request when scanning incoming DNS requests, the Microsoft bulletin states. An attacker could send a specially malformed request to the ISA Server that is publishing a DNS server. In turn, the attack could result in a denial of service to the published DNS server.

"DNS requests arriving at the ISA Server would be stopped at the firewall, and not passed through to the internal DNS server. All other ISA Server functionality would be unaffected," the bulletin states.

One important mitigating factor is that DNS servers are not published by default -- DNS publishing must be manually enabled in ISA Server.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • Report: Security Initiatives Can't Keep Pace with Cloud, AI Boom

    The increasingly fast adoption of hybrid, multicloud, and AI systems is easily outgrowing existing security measures, according to a recent global survey by the Cloud Security Alliance (CSA) and exposure management firm Tenable.

  • World Map Image

    Microsoft Taps Nebius in $17B AI Infrastructure Deal To Alleviate Cloud Strain

    Microsoft has signed a five-year, $17.4 billion agreement with Amsterdam-based Nebius Group to expand its AI computing capabilities through third-party GPU infrastructure.