Microsoft ISA Server Redirect URI Handler Web Proxy Service Remote Denial Of Service Vulnerability
BID:10482
Info
Microsoft ISA Server Redirect URI Handler Web Proxy Service Remote Denial Of Service Vulnerability
| Bugtraq ID: | 10482 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 01 2003 12:00AM |
| Updated: | Jul 01 2003 12:00AM |
| Credit: | The vendor announced this vulnerability. |
| Vulnerable: |
Microsoft ISA Server 2000 SP1 Microsoft ISA Server 2000 FP1 Microsoft ISA Server 2000 |
| Not Vulnerable: |
Microsoft ISA Server 2000 SP2 |
Discussion
Microsoft ISA Server Redirect URI Handler Web Proxy Service Remote Denial Of Service Vulnerability
Microsoft Internet Security and Acceleration (ISA) Server web proxy service is reported prone to a remote denial of service vulnerability. The issue is reported to exist because ISA server may fail to terminate a redirect URI string with a NULL byte when copying the URI into a temporary buffer. As a result of this failure, a read operation performed on the temporary buffer will read beyond its bounds, potentially resulting in a read access violation in the W3proxy.exe executable.
Microsoft Internet Security and Acceleration (ISA) Server web proxy service is reported prone to a remote denial of service vulnerability. The issue is reported to exist because ISA server may fail to terminate a redirect URI string with a NULL byte when copying the URI into a temporary buffer. As a result of this failure, a read operation performed on the temporary buffer will read beyond its bounds, potentially resulting in a read access violation in the W3proxy.exe executable.
Exploit / POC
Microsoft ISA Server Redirect URI Handler Web Proxy Service Remote Denial Of Service Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Microsoft ISA Server Redirect URI Handler Web Proxy Service Remote Denial Of Service Vulnerability
Solution:
Microsoft has released a service pack to address this vulnerability and other issues:
Microsoft ISA Server 2000 SP1
Solution:
Microsoft has released a service pack to address this vulnerability and other issues:
Microsoft ISA Server 2000 SP1
-
Microsoft Internet Security and Acceleration (ISA) Server 2000 Service Pack 2
http://www.microsoft.com/downloads/details.aspx?FamilyID=c8d3d98b-1cd4 -406a-a04a-2aa2547d09a3&DisplayLang=en
References
Microsoft ISA Server Redirect URI Handler Web Proxy Service Remote Denial Of Service Vulnerability
References:
References:
- Microsoft Knowledge Base Article - 818136 (Microsoft)