Select the product you need help with
- Internet Explorer
- Windows Phone
- More products
MS03-009: A Problem in the ISA Server DNS Intrusion Detection Filter May Cause Denial of Service
Article ID: 331065 - View products that this article applies to.
This article was previously published under Q331065
A problem may occur on an Internet Security and Acceleration (ISA) Server 2000-based computer during the processing of incoming Domain Name System (DNS) requests that are sent to a published internal DNS server.
A successful attack against the ISA Server-based computer requires a malicious DNS request. An attacker might be able to exploit the vulnerability by sending a specially formed request to an ISA Server-based computer that is publishing a DNS server. This might then result in a denial of service to the published DNS server. If this occurs, all future incoming DNS requests to the ISA Server-based computer are stopped at the firewall, and are not passed to the internal DNS server. All other ISA Server functionality is unaffected.
The vulnerability exists because the ISA Server DNS intrusion detection filter does not handle a specific type of request correctly when it is scanning incoming DNS traffic.
Download InformationThe following file is available for download from the Microsoft Download Center:
Release Date: March 19, 2003
Download the Isahf256.exe package now.
Collapse this imageExpand this image
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
(http://support.microsoft.com/kb/119591/EN-US/ )How to Obtain Microsoft Support Files from Online Services
PrerequisitesYou must install ISA Server Service Pack 1 (SP1) before you apply the hotfix.
For additional information about how to obtain the latest ISA Server service pack, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/313139/EN-US/ )How to Obtain the Latest Internet Security and Acceleration Server 2000 Service Pack
Installation InformationThis update supports the following Setup switches:
isahf256 /qTo verify that the update is installed on your computer, confirm that the following registry key exists:
Removal InformationYou can remove this update by using the Add/Remove Programs tool in Control Panel to remove "Microsoft ISA Server 2000 Updates."
You can also remove this update by typing the following line at a command prompt:
Hotfix Replacement InformationThis update does not replace any other updates.
Restart RequirementYou do not have to restart your computer after you apply this update.
File InformationThe English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name -------------------------------------------------------- 9-Mar-2003 11:55 3.0.1200.256 77,072 Issfltr.dll
Microsoft has confirmed that this problem may cause a degree of security vulnerability in the Microsoft products that are listed at the beginning of this article.
For more information about this issue, view the following security bulletin:
Microsoft Security Bulletin MS03-009
Article ID: 331065 - Last Review: October 29, 2007 - Revision: 4.3