Microsoft Corp. admitted Monday that a flaw in its Internet Security and Acceleration (ISA) Server 1.0 can lead to a Denial of Service attack (DoS), taking Web sites and users employing the product offline until the server is restarted.
ISA Server offers firewall, virtual private network services and a Web cache to its users. The bug in ISA Server can be attacked in three ways, according to Richard Reiner, the chief executive officer and head of the e-security practice at SecureXpert Labs in Toronto.
If ISA Server’s Web server features — called Web publishing — are turned on, a certain string of characters can be sent to the server to shut it down. This is a very simple attack that anyone with a modem could perpetrate in only a minute, Reiner said. This poses two problems to anyone using the Web publishing feature: The attack will take the Web site served by ISA offline and it will also stop any users behind the firewall from accessing the Web until the server is restarted, Reiner said.
ISA Server can also be crashed using the same attack by anyone inside the company using the software, regardless of whether the Web publishing feature is turned on or not, Reiner said. Lastly, if an HTML (Hypertext Markup Language) e-mail containing certain text in an image tag is sent to anyone within the company using the firewall, ISA can be crashed, Reiner said. HTML is frequently included in e-mail sent by modern e-mail programs.
Reiner, who, along with Graham Wiseman, Matthew Siemens and Kent Nicolson discovered the vulnerability, found the flaw in the first 15 minutes of installing ISA in SecureXpert Labs’ testing facilities, he said. The vulnerability was “pretty glaring … not something of great subtlety,” he said.
Microsoft touted ISA as the company’s first security product when it announced ISA in early February. Though it is just the company’s first offering in the security area, Microsoft worked with a number of established partners on the product and should not have let such a bug slip through, Reiner said.
“They don’t have any excuses,” he said.
The flaw, which was discovered by a four-man team at Toronto’s SecureXpert Labs, was reported to Microsoft on April 2, and Microsoft, in turn, reported the bug over the BugTraq security e-mail list on Monday. The company has already released a patch to remedy the problem, available now on its Web site.
The two weeks between SecureXpert’s notifying Microsoft of the bug and the company’s response is “not an excessive period of time,” Reiner said. Some companies move faster, but some much slower, sometimes taking as much as a month or more to fix their bugs, he said. As such, “two weeks is not bad performance.”
Microsoft was not immediately available for comment.
Microsoft, in Redmond, Washington, can be reached at +1-425-882-8080 or via the Internet at http://www.microsoft.com. The patch to fix the ISA bus is available at http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29081. SecureXpert Labs in Toronto, can be reached at 416-921-4280 or online at http://www.securexpert.com.
