{"id": "SECURITYVULNS:DOC:8780", "bulletinFamily": "software", "title": "[NT] Microsoft ISA Server 2000 DoS", "description": "The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam\r\nweb site: http://www.securiteam.com\r\n- - promotion\r\n\r\nThe SecuriTeam alerts list - Free, Accurate, Independent.\r\n\r\nGet your security news from a reliable source.\r\nhttp://www.securiteam.com/mailinglist.html \r\n\r\n- - - - - - - - -\r\n\r\n\r\n\r\n Microsoft ISA Server 2000 DoS\r\n------------------------------------------------------------------------\r\n\r\n\r\nSUMMARY\r\n\r\n" <http://www.microsoft.com/isaserver/default.mspx> Microsoft Internet \r\nSecurity and Acceleration (ISA) Server is the advanced stateful packet and \r\napplication-layer inspection firewall, virtual private network (VPN), and \r\nWeb cache solution that enables enterprise customers to easily maximize \r\nexisting information technology (IT) investments by improving network \r\nsecurity and performance."\r\n\r\nMicrosoft Internet Security and Acceleration Server's Firewall crashes \r\nwhen heavy network traffic is received from a SecureNAT client.\r\n\r\nDETAILS\r\n\r\nVulnerable Systems:\r\n * SA Server 2000 and ISA Server 2000 Service Pack 2 (SP2) Wspsrv.exe \r\nversion 3.0.1200.411 and prior\r\n\r\nWorkaround:\r\nLimit the size of traffic being handled by the ISA server for each \r\nSecureNAT client contacting it.\r\n\r\nDisclosure Timeline:\r\n01-06-2005 - Vulnerability researched\r\n02-06-2005 - Security companies and several CERT units contacted, advisory \r\npublished, link to advisory sent to security companies and several CERT \r\nunits\r\n\r\n\r\nADDITIONAL INFORMATION\r\n\r\nThe information has been provided by <mailto:juha-matti.laurio@netti.fi> \r\nJuha-Matti Laurio .\r\nThe original article can be found at: \r\n<http://www.networksecurity.fi/advisories/windows-isa-firewall.html> \r\nhttp://www.networksecurity.fi/advisories/windows-isa-firewall.html\r\nThe vendor advisory can be found at : \r\n<http://support.microsoft.com/kb/894864/EN-US/> \r\nhttp://support.microsoft.com/kb/894864/EN-US/\r\n\r\n\r\n\r\n======================================== \r\n\r\n\r\nThis bulletin is sent to members of the SecuriTeam mailing list. \r\nTo unsubscribe from the list, send mail with an empty subject line and body to:\r\nlist-unsubscribe@securiteam.com \r\nIn order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com \r\n\r\n\r\n==================== \r\n==================== \r\n\r\nDISCLAIMER: \r\nThe information in this bulletin is provided "AS IS" without warranty of any kind. \r\nIn no event shall we be liable for any damages whatsoever including direct, indirect, incidental,\r\nconsequential, loss of business profits or special damages. \r\n\r\n\r\n\r\n", "published": "2005-06-02T00:00:00", "modified": "2005-06-02T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:8780", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:13", "edition": 1, "viewCount": 0, "enchantments": {"score": {"value": 5.7, "vector": "NONE", "modified": "2018-08-31T11:10:13", "rev": 2}, "dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562311220181206", "OPENVAS:1361412562310143942", "OPENVAS:1361412562311220181207", "OPENVAS:1361412562311220181275", "OPENVAS:1361412562311220191428"]}, {"type": "msupdate", "idList": ["MS:298C3484-E049-4C7C-BBEC-06947CB7DC45"]}, {"type": "nessus", "idList": ["NEWSTART_CGSL_NS-SA-2019-0245_RUBY.NASL", "REDHAT-RHSA-2020-0591.NASL", "REDHAT-RHSA-2020-0542.NASL", "REDHAT-RHSA-2020-0663.NASL", "NEWSTART_CGSL_NS-SA-2019-0221_RUBY.NASL"]}, {"type": "redhat", "idList": ["RHSA-2020:0663", "RHSA-2020:0542", "RHSA-2020:0591"]}, {"type": "cve", "idList": ["CVE-2008-7273", "CVE-2014-2595", "CVE-2008-7272"]}, {"type": "apple", "idList": ["APPLE:HT209193", "APPLE:HT210603", "APPLE:HT210604"]}], "modified": "2018-08-31T11:10:13", "rev": 2}, "vulnersScore": 5.7}, "affectedSoftware": []}

{"rst": [{"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **property-exposure[.]ru** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2019-12-15T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **spam**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2019-12-15T00:00:00", "id": "RST:49149060-AF9D-3CBF-8780-315C5A7F8986", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: property-exposure.ru", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **stark74binden[.]de** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2019-12-15T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **spam**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2019-12-15T00:00:00", "id": "RST:FB97FE82-2DE7-3EDB-8780-427EB365833E", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: stark74binden.de", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-21T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **45[.]113.32.180** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **48**.\n First seen: 2020-11-21T03:00:00, Last seen: 2020-11-21T03:00:00.\n IOC tags: **shellprobe**.\nASN 63959: (First IP 45.113.32.0, Last IP 45.113.32.255).\nASN Name \"HKSTLHK\" and Organisation \"Hong Kong Syscloud Technology Limited\".\nASN hosts 2 domains.\nGEO IP information: City \"\", Country \"Hong Kong\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-11-21T00:00:00", "id": "RST:EC7EA647-EF12-343E-8780-5D6A9CE5E2BD", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: 45.113.32.180", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **mongleasisanli[.]tk** in [RST Threat Feed](https://rstcloud.net/profeed) with score **19**.\n First seen: 2020-09-10T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **generic**.\nDomain has DNS A records: 172[.]67.180.115,104.27.186.171,104.27.187.171\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-09-10T00:00:00", "id": "RST:34B73B9E-D5AD-3B43-8780-9E7E572D660E", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: mongleasisanli.tk", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **koplak[.]web.id** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2019-12-15T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **spam**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2019-12-15T00:00:00", "id": "RST:18107764-63F1-3986-8780-D593E4985320", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: koplak.web.id", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-17T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **58[.]216.67.49** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **10**.\n First seen: 2020-01-26T03:00:00, Last seen: 2020-11-17T03:00:00.\n IOC tags: **malware**.\nASN 4134: (First IP 58.216.67.0, Last IP 58.216.86.255).\nASN Name \"CHINANETBACKBONE\" and Organisation \"No31Jinrong Street\".\nASN hosts 1124911 domains.\nGEO IP information: City \"\", Country \"China\".\nIOC could be a **False Positive** (Cloud provider IP).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-01-26T00:00:00", "id": "RST:521B49C4-7374-3497-8780-BA97C8B0E98A", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: 58.216.67.49", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **58[.]26.175.119** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **4**.\n First seen: 2020-02-14T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **generic**.\nASN 4788: (First IP 58.26.0.0, Last IP 58.27.43.255).\nASN Name \"TMNETASAP\" and Organisation \"TM Net Internet Service Provider\".\nASN hosts 9619 domains.\nGEO IP information: City \"Klang\", Country \"Malaysia\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-02-14T00:00:00", "id": "RST:72500C8F-9192-39E7-8780-AC7B3A3501B1", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: 58.26.175.119", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **alohasoftware[.]net** in [RST Threat Feed](https://rstcloud.net/profeed) with score **3**.\n First seen: 2019-12-12T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **generic**.\nDomain has DNS A records: 173[.]247.243.223\nWhois:\n Created: 2000-11-15 22:38:15, \n Registrar: GoDaddycom LLC, \n Registrant: unknown.\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2019-12-12T00:00:00", "id": "RST:A234AB0D-24D5-3262-8780-14368B1512EB", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: alohasoftware.net", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **6u7n6u[.]com** in [RST Threat Feed](https://rstcloud.net/profeed) with score **20**.\n First seen: 2020-01-29T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **spam**.\nWhois:\n Created: 2019-10-07 07:27:00, \n Registrar: GMO Internet Inc dba Onamaecom, \n Registrant: unknown.\nIOC could be a **False Positive** (Domain not resolved, but Whois records found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-01-29T00:00:00", "id": "RST:77911477-DC63-3D3D-8780-A816BCE9CD4E", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: 6u7n6u.com", "type": "rst", "cvss": {}}, {"lastseen": "2020-11-20T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **exactshape[.]co.uk** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2019-12-15T03:00:00, Last seen: 2020-11-20T03:00:00.\n IOC tags: **spam**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2019-12-15T00:00:00", "id": "RST:6364176D-53A1-30ED-8780-8E1938A9EE41", "href": "", "published": "2020-11-21T00:00:00", "title": "RST Threat feed. IOC: exactshape.co.uk", "type": "rst", "cvss": {}}]}