Microsoft ISA Server HTTP/HTTPS Service Basic Auth Information Disclosure Vulnerability
BID:13955
Info
Microsoft ISA Server HTTP/HTTPS Service Basic Auth Information Disclosure Vulnerability
| Bugtraq ID: | 13955 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 14 2005 12:00AM |
| Updated: | Jun 14 2005 12:00AM |
| Credit: | Discovery of this issue is credited to Han Valk. |
| Vulnerable: |
Microsoft ISA Server 2000 Enterprise Edition SP2 Microsoft ISA Server 2000 Enterprise Edition SP1 Microsoft ISA Server 2000 Enterprise Edition Microsoft ISA Server 2000 SP2 Microsoft ISA Server 2000 SP1 Microsoft ISA Server 2000 |
| Not Vulnerable: |
Microsoft ISA Server 2004 |
Discussion
Microsoft ISA Server HTTP/HTTPS Service Basic Auth Information Disclosure Vulnerability
Microsoft Internet Security and Acceleration (ISA) server is prone to an information disclosure vulnerability. Reports indicate that the issue manifests when an ISA server is publishing a Web service that has Basic authentication enabled, but the Web publishing rules that process the request are configured as 'SSL required'.
An attacker that has the ability to intercept network communications between the ISA server and a client may leverage this issue to obtain Web site authentication credentials.
Microsoft Internet Security and Acceleration (ISA) server is prone to an information disclosure vulnerability. Reports indicate that the issue manifests when an ISA server is publishing a Web service that has Basic authentication enabled, but the Web publishing rules that process the request are configured as 'SSL required'.
An attacker that has the ability to intercept network communications between the ISA server and a client may leverage this issue to obtain Web site authentication credentials.
Exploit / POC
Microsoft ISA Server HTTP/HTTPS Service Basic Auth Information Disclosure Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Microsoft ISA Server HTTP/HTTPS Service Basic Auth Information Disclosure Vulnerability
Solution:
Microsoft has released a fix to address this issue.
Microsoft ISA Server 2000 Enterprise Edition SP2
Microsoft ISA Server 2000 SP1
Microsoft ISA Server 2000
Microsoft ISA Server 2000 SP2
Solution:
Microsoft has released a fix to address this issue.
Microsoft ISA Server 2000 Enterprise Edition SP2
-
Microsoft Microsoft Internet Security and Acceleration (ISA) Server 2000 Cumulative Security Update
ISA Server Service Pack 2 must be installed prior to the installation of this update.
http://www.microsoft.com/downloads/details.aspx?familyid=E579813B-0372 -45BE-8070-3F4D7D4CB89C&displaylang=en
Microsoft ISA Server 2000 SP1
-
Microsoft Microsoft Internet Security and Acceleration (ISA) Server 2000 Cumulative Security Update
ISA Server Service Pack 2 must be installed prior to the installation of this update.
http://www.microsoft.com/downloads/details.aspx?familyid=E579813B-0372 -45BE-8070-3F4D7D4CB89C&displaylang=en
Microsoft ISA Server 2000
-
Microsoft Microsoft Internet Security and Acceleration (ISA) Server 2000 Cumulative Security Update
ISA Server Service Pack 2 must be installed prior to the installation of this update.
http://www.microsoft.com/downloads/details.aspx?familyid=E579813B-0372 -45BE-8070-3F4D7D4CB89C&displaylang=en
Microsoft ISA Server 2000 SP2
-
Microsoft Microsoft Internet Security and Acceleration (ISA) Server 2000 Cumulative Security Update
ISA Server Service Pack 2 must be installed prior to the installation of this update.
http://www.microsoft.com/downloads/details.aspx?familyid=E579813B-0372 -45BE-8070-3F4D7D4CB89C&displaylang=en
References
Microsoft ISA Server HTTP/HTTPS Service Basic Auth Information Disclosure Vulnerability
References:
References: