CVE-2009-1135

Microsoft Internet Security and Acceleration ISA Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to...

Design/Logic Flaw

Microsoft Internet Security and Acceleration ISA Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to...

CVE-2009-1135

CVE-2009-1135 affects Microsoft ISA Server 2006 (Gold/SP1) when Radius OTP is enabled. The vulnerability stems from ISA Server using HTTP-Basic authentication for Radius OTP-enabled requests, which can let a remote attacker impersonate a valid user and access published web resources behind the IS...

Microsoft ISA Server Privilege Escalation Vulnerability (970953)

This host is missing a critical security update according to Microsoft Bulletin MS09-031. OpenVAS Vulnerability Test $Id: secpodms09-031.nasl 5363 2017-02-20 13:07:22Z cfi $ Microsoft ISA Server Privilege Escalation Vulnerability 970953 Authors: Nikita MR Copyright Copyright c 2009 SecPod,...

Microsoft ISA Server Radius OTP验证绕过漏洞

Bugraq ID: 35631 CVE ID：CVE-2009-1135 Microsoft ISA Server是一款企业防火墙和高性能的Web缓存解决方案。 配置了Radius OTP的ISA Server 2006验证机制存在问题，远程攻击者可以利用漏洞绕过验证访问受限WEB资源。 当使用HTTP-Basic方法验证请求时存在未明错误，可导致访问WEB发布的资源。 成功利用漏洞需要合法管理用户名和ISA服务器配置了Radius一次性密码OTP验证和KCDKerberos Constrained Delegation的验证委托。 Microsoft ISA Server 2006...

Microsoft ISA Server Privilege Escalation Vulnerability (970953)

This host is missing a critical security update according to Microsoft Bulletin MS09-031. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Inside Microsoft's July Security Patch Batch

Microsoft released six security bulletins today — three rated Critical and three rated Important. Two of the issues are being actively exploited on the Internet and four of the issues are client-side vulnerabilities, which means the exploit can only occur if a user visits an evil website or opens...

Microsoft ISA Server RADIUS authentication bypass

It's psosible to bypass form-based authntication if server is set to use RADIUS authentication with One Type passwords...

Microsoft ISA Server 2006 Radius OTP Bypass (MS09-031; CVE-2009-1135)

ISA Server, originating as Microsoft Proxy Server, is a Firewall & Security product that provides Application-Layer Firewalling, acts as a VPN endpoint, and provides Internet Access for client systems in a Business Networking environment. An elevation of privilege vulnerability exists in Microsof...

Microsoft Security Bulletin MS09-031 - Important Vulnerability in Microsoft ISA Server 2006 Could Cause Elevation of Privilege (970953)

Microsoft Security Bulletin MS09-031 - Important Vulnerability in Microsoft ISA Server 2006 Could Cause Elevation of Privilege 970953 Published: July 14, 2009 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Microsoft Internet...

Microsoft ISA Server Radius OTP Authentication Bypass Vulnerability

Description Microsoft ISA Server is prone to an authentication-bypass vulnerability. An attacker with knowledge of a valid account name can exploit this issue to bypass authentication and gain access to arbitrary resources within the context of the selected account. Technologies Affected Microsof...

MS09-031: Vulnerability in Microsoft ISA Server 2006 Could Cause Elevation of Privilege (970953)

The version of Microsoft Internet Security and Acceleration ISA Server 2006 installed on the remote host may allow an unauthenticated attacker with knowledge of administrator account usernames to gain access to published resources in the context of such a user without having to authenticate with...

多个Symantec产品RAR/TAR/ZIP文件扫描绕过漏洞

Bugraq ID: 35354 多个Symantec产品对畸形或特殊格式的压缩档文件如tar/zip/rar/缺少真确处理，可导致绕过扫描产品的检测。 攻击者构建恶意的文件，发送给目标用户，可绕过检测使应用程序展开并执行。 目前没有详细漏洞细节提供。 Symantec Symantec AntiVirus Scan Engine for Microsoft ISA 4.3.12 Symantec Symantec AntiVirus Corporate Edition 10.2 MR2 Symantec Scan Engine 5.1.6.31 Symantec Scan Engine...

CVE-2009-1348

The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via 1 an invali...

Microsoft ISA Server and Forefront Threat Management Gateway DoS Vulnerability (961759)

This host is missing a critical security update according to Microsoft Bulletin MS09-016. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft ISA Server和Forefront TMG拒绝服务漏洞（MS09-016）

BUGTRAQ ID: 34414 CVECAN ID: CVE-2009-0077 Microsoft ISA Server和Forefront TMG都是微软产品家族中的安全组件，可提供防火墙、安全网关等功能。 防火墙引擎在为Web代理或者Web发布监听器处理TCP状态的方式可能会留下孤儿开放会话，这允许远程用户导致Web监听器停止响应新请求。 Microsoft ISA Server 2006可支持性升级 Microsoft ISA Server 2006 SP1 Microsoft ISA Server 2006 Microsoft ISA Server 2004 SP3...

Microsoft ISA Server和Forefront TMG跨站脚本漏洞（MS09-016）

BUGTRAQ ID: 34416 CVECAN ID: CVE-2009-0237 Microsoft ISA Server和Forefront TMG都是微软产品家族中的安全组件，可提供防火墙、安全网关等功能。 ISA Server或Forefront TMG中的HTML表单认证组件cookieauth.dll没有正确地对HTTP流执行输入验证，允许恶意脚本代码扮演为运行cookieauth.dll的服务器在其他用户的设备上运行，导致跨站脚本攻击。 Microsoft ISA Server 2006可支持性升级 Microsoft ISA Server 2006 SP1...

Cross site scripting

Cross-site scripting XSS vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition TMG MBE; and Internet Security and Acceleration ISA Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote...

Denial of service

The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition TMG MBE; and Internet Security and Acceleration ISA Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote...

CVE-2009-0237

Cross-site scripting XSS vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition TMG MBE; and Internet Security and Acceleration ISA Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote...