Microsoft ISA Server HTTP Authentication Scheme Vulnerability
BID:10481
Info
Microsoft ISA Server HTTP Authentication Scheme Vulnerability
| Bugtraq ID: | 10481 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 07 2003 12:00AM |
| Updated: | Sep 07 2003 12:00AM |
| Credit: | This issue was publicly disclosed in the referenced vendor web advisory. The individual responsible for discovery is currently unknown. |
| Vulnerable: |
Microsoft ISA Server 2000 SP1 Microsoft ISA Server 2000 |
| Not Vulnerable: |
Microsoft ISA Server 2000 SP2 |
Discussion
Microsoft ISA Server HTTP Authentication Scheme Vulnerability
Microsoft Internet Security and Acceleration (ISA) Server is affected by an HTTP authentication scheme vulnerability. This issue is due to a design error that allows users to authenticate using insecure schemes regardless of a configuration that requires SSL.
This issue would potentially lead an unsuspecting user to attempt to authenticate to a web application over insecure channels; attackers may be able to read plaintext authentication credentials even when the affected server is configured to require SSL transactions.
Microsoft Internet Security and Acceleration (ISA) Server is affected by an HTTP authentication scheme vulnerability. This issue is due to a design error that allows users to authenticate using insecure schemes regardless of a configuration that requires SSL.
This issue would potentially lead an unsuspecting user to attempt to authenticate to a web application over insecure channels; attackers may be able to read plaintext authentication credentials even when the affected server is configured to require SSL transactions.
Exploit / POC
Microsoft ISA Server HTTP Authentication Scheme Vulnerability
No exploit is required to leverage this issue.
No exploit is required to leverage this issue.
Solution / Fix
Microsoft ISA Server HTTP Authentication Scheme Vulnerability
Solution:
Microsoft has released Internet Security and Acceleration (ISA) Server 2000 Service Pack 2 dealing with this issue.
Microsoft ISA Server 2000 SP1
Solution:
Microsoft has released Internet Security and Acceleration (ISA) Server 2000 Service Pack 2 dealing with this issue.
Microsoft ISA Server 2000 SP1
-
Microsoft Internet Security and Acceleration (ISA) Server 2000 Service Pack 2
http://www.microsoft.com/downloads/details.aspx?FamilyID=c8d3d98b-1cd4 -406a-a04a-2aa2547d09a3&DisplayLang=en
References
Microsoft ISA Server HTTP Authentication Scheme Vulnerability
References:
References: