News

Flaw Found in Microsoft Enterprise Firewall

• By Scott Bekker
• March 20, 2003

Microsoft's enterprise firewall contains a security hole that attackers could use to cause denial-of-service conditions in internal Domain Name Service servers. The security flaw with Internet Security & Acceleration Server rates as a "moderate" security risk, Microsoft security officials determined.

The security bulletin and patch were posted Wednesday night and are available at www.microsoft.com/technet/security/bulletin/MS03-009.asp.

The bulletin makes clear that the flaw cannot be used to take control of the ISA Server 2000 machine or servers behind the firewall that it protects. The flaw involves a feature of ISA Server that provides application-specific processing of incoming traffic. The feature is designed to protect against invalid URLs that are common to attacks against internal DNS servers.

The flaw involves ISA's DNS intrusion application filter, which improperly handles a specific type of request when scanning incoming DNS requests, the Microsoft bulletin states. An attacker could send a specially malformed request to the ISA Server that is publishing a DNS server. In turn, the attack could result in a denial of service to the published DNS server.

"DNS requests arriving at the ISA Server would be stopped at the firewall, and not passed through to the internal DNS server. All other ISA Server functionality would be unaffected," the bulletin states.

One important mitigating factor is that DNS servers are not published by default -- DNS publishing must be manually enabled in ISA Server.