MS09-016: Vulnerabilities in ISA Server and Forefront Threat Management Gateway MBE could cause denial of service

Microsoft has released security bulletin MS09-016. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/protect/computer/updates/bulletins/200904.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200904.mspx)
  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
  http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/MS09-016.mspx (http://www.microsoft.com/technet/security/bulletin/MS09-016.mspx)

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site: North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site: For enterprise customers, support for security updates is available through your usual support contacts.

Known issues with this security update

An administrator may be able to install the wrong version of the ISA Server 2006 update if it was obtained from the Microsoft Download Center (DC). When this occurs, the update will indicate successful installation, but the relevant binaries will not be updated to the new versions.

This problem may occur because of a problem in the installer detection logic that does not correctly determine the installed ISA Server 2006 product revision. This problem will not occur if the ISA 2006 computer is updated by using Microsoft Update, Automatic Updates, Windows Server Update Services, or SMS.
To correct an incorrect update installation, download, and then install the correct package for the target system over the current update.

Additional information about this security update

For more information about this security update and for information about any known issues with specific releases of this software, click the following article number to view the article in the Microsoft Knowledge Base:

FILE INFORMATION

In addition to the products that are listed in the Applies To section, the information in this article also applies to:

• Microsoft ISA Server 2004, Enterprise Edition, Service Pack 3 (SP3)
• Microsoft ISA Server 2004, Standard Edition, Service Pack 3 (SP3)
• Microsoft ISA Server 2006, Enterprise Edition, Supportability Update (SU)
• Microsoft ISA Server 2006, Standard Edition, Supportability Update (SU)