Microsoft Security Bulletin MS04-039:
Vulnerability in ISA Server 2000 and Proxy Server 2.0 Could Allow Internet
Content Spoofing (888258)
Bulletin URL:
<http://www.microsoft.com/technet/security/bulletin/MS04-039.mspx>
Reason for Revision: Bulletin updated to reflect the release of an updated ISA
Server 2000 security update for the German language only. This issue does not
affect any other language version of this security update.
Version Number: 2.0
Issued Date: Tuesday, November 09, 2004
Revision Date: Tuesday, November 09, 2004
Impact of Vulnerability: Spoofing
Maximum Severity Rating: Important
Patch(es) Replaced: None
Caveats: None
Tested Software:
Affected Software:
------------------
* Microsoft Proxy Server 2.0 Service Pack 1
<http://tinyurl.com/65vb5>
* Microsoft Internet Security and Acceleration Server 2000 Service Pack 1 and
Microsoft Internet Security and Acceleration Server 2000 Service Pack 2 Note
The following software programs include Microsoft Internet Security and
Acceleration Server 2000 (ISA Server 2000). Customers using these software
programs should install the provided ISA Server 2000 security update.
- Microsoft Small Business Server 2000
- Microsoft Small Business Server 2003 Premium Edition
<http://tinyurl.com/59pf4>
Technical Description:
----------------------
* Spoofing Vulnerability - CAN-2004-0892: This is a spoofing vulnerability that
exists in the affected products and that could enable an attacker to spoof
trusted Internet content. Users could believe they are accessing trusted
Internet content when in reality they are accessing malicious Internet content,
for example a malicious Web site. However, an attacker would first have to
persuade a user to visit the attacker's site to attempt to exploit this
vulnerability.
Revision History:
-----------------
* v1.0 - 11/9/2004: Bulletin published
* v2.0 - 11/9/2004: Bulletin updated to reflect the release of an updated ISA
Server 2000 security update for the German language only. This issue does not
affect any other language version of this security update.
This email is sent to NTBugtraq automagically as a service to my subscribers.
(v4.01.1664.40858)
Cheers,
Russ - Senior Scientist - TruSecure Corporation/NTBugtraq Editor
--
Editor's Note: The 43rd Most Powerful Person in Networking says...
Register today to take the TruSecure ICSA exam by 12/31/04 at
<http://www.2test.com> , use promo code "CT1204" and you will pay just
$221.25 US Dollars for domestic exam delivery and $296.25 US Dollars
for international delivery.
Visit <https://ticsa.trusecure.com> for complete details regarding the
TICSA credential and to take the free sample exam.
--
