News

Flaw Found in Microsoft Enterprise Firewall

Microsoft's enterprise firewall contains a security hole that attackers could use to cause denial-of-service conditions in internal Domain Name Service servers. The security flaw with Internet Security & Acceleration Server rates as a "moderate" security risk, Microsoft security officials determined.

The security bulletin and patch were posted Wednesday night and are available at www.microsoft.com/technet/security/bulletin/MS03-009.asp.

The bulletin makes clear that the flaw cannot be used to take control of the ISA Server 2000 machine or servers behind the firewall that it protects. The flaw involves a feature of ISA Server that provides application-specific processing of incoming traffic. The feature is designed to protect against invalid URLs that are common to attacks against internal DNS servers.

The flaw involves ISA's DNS intrusion application filter, which improperly handles a specific type of request when scanning incoming DNS requests, the Microsoft bulletin states. An attacker could send a specially malformed request to the ISA Server that is publishing a DNS server. In turn, the attack could result in a denial of service to the published DNS server.

"DNS requests arriving at the ISA Server would be stopped at the firewall, and not passed through to the internal DNS server. All other ISA Server functionality would be unaffected," the bulletin states.

One important mitigating factor is that DNS servers are not published by default -- DNS publishing must be manually enabled in ISA Server.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Offers Support Extensions for Exchange 2016 and 2019

    Microsoft has introduced a paid Extended Security Update (ESU) program for on-premises Exchange Server 2016 and 2019, offering a crucial safety cushion as both versions near their Oct. 14, 2025 end-of-support date.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Notebook

    Microsoft Centers AI, Security and Partner Dogfooding at MCAPS

    Microsoft's second annual MCAPS for Partners event took place Tuesday, delivering a volley of updates and directives for its partners for fiscal 2026.

  • Microsoft Layoffs: AI Is the Obvious Elephant in the Room

    As Microsoft doubles down on an $80 billion bet on AI this fiscal year, its workforce reductions are drawing scrutiny over whether AI's ascent is quietly reshaping its human capital strategy, even as official messaging avoids drawing a direct line.