Select the product you need help with
MS03-009: A Problem in the ISA Server DNS Intrusion Detection Filter May Cause Denial of ServiceArticle ID: 331065 - View products that this article applies to. This article was previously published under Q331065 On This PageSYMPTOMS A problem may occur on an Internet Security and
Acceleration (ISA) Server 2000-based computer during the processing of incoming
Domain Name System (DNS) requests that are sent to a published internal DNS
server. A successful attack against the ISA Server-based computer requires a malicious DNS request. An attacker might be able to exploit the vulnerability by sending a specially formed request to an ISA Server-based computer that is publishing a DNS server. This might then result in a denial of service to the published DNS server. If this occurs, all future incoming DNS requests to the ISA Server-based computer are stopped at the firewall, and are not passed to the internal DNS server. All other ISA Server functionality is unaffected. CAUSEThe vulnerability exists because the ISA Server DNS
intrusion detection filter does not handle a specific type of request correctly
when it is scanning incoming DNS traffic. RESOLUTIONPatch InformationDownload InformationThe following file is available for download from the Microsoft Download Center:Collapse this image 
(http://microsoft.com/downloads/details.aspx?FamilyId=F62127C5-51E3-4B34-A6D3-B9CF840358BD&displaylang=en)
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
(http://support.microsoft.com/kb/119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
PrerequisitesYou must install ISA Server Service Pack 1 (SP1) before you apply the hotfix.For additional information about how to obtain the latest ISA Server service pack, click the following article number to view the article in the Microsoft Knowledge Base: 313139
(http://support.microsoft.com/kb/313139/EN-US/
)
How to Obtain the Latest Internet Security and Acceleration Server 2000 Service Pack
Installation InformationThis update supports the following Setup switches:
isahf256 /q To verify that the update is installed on your computer, confirm
that the following registry key exists: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc\Hotfixes\SP1\256 Removal InformationYou can remove this update by using the Add/Remove Programs tool in Control Panel to remove "Microsoft ISA Server 2000 Updates."You can also remove this update by typing the following line at a command prompt: isahf256 -UHF256 Hotfix Replacement InformationThis update does not replace any other updates.Restart RequirementYou do not have to restart your computer after you apply this update.File InformationThe English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Date Time Version Size File name -------------------------------------------------------- 9-Mar-2003 11:55 3.0.1200.256 77,072 Issfltr.dll STATUS Microsoft has confirmed that this problem
may cause a degree of security vulnerability in the Microsoft products that are
listed at the beginning of this article.
MORE INFORMATIONFor more information about this issue, view the following
security bulletin: Microsoft Security Bulletin MS03-009
(http://www.microsoft.com/technet/security/bulletin/MS03-009.mspx)
PropertiesArticle ID: 331065 - Last Review: October 29, 2007 - Revision: 4.3 APPLIES TO
|
Back to the top
