ISA Server Is Only Half Patched

  • By Jabulani Leffall
  • 07/21/09

Microsoft's clarification of an Internet Security and Acceleration (ISA) Server patch released this month has left at least one security expert stumped.

The heart of the matter involves security advisory (973472), which was released on Monday of last week. Bulletin 973472 describes possible vulnerabilities affecting Redmond's ISA Server, specifically an ActiveX bug associated with Office Web Components (OWC). That security advisory should not to be confused with the ISA Server fix associated with a Radius One Time password setting that was addressed in the July security patch released on Tuesday.

The important part seems to be how OWC is used in ISA Server, according to David B. Cross, a product unit manager at Microsoft's Server Products Division.

"As many customers have noticed, ISA Server 2004 and ISA Server 2006 were included [in the security advisory] on the 'Applies to' product list," Cross said in a Forefront team blog, while noting that ISA Server 2000 and Forefront Threat Management Gateway aren't included. Cross goes on to say that the OWC vulnerability affecting ISA Server can be mitigated as "ISA report generation does not use the vulnerable OWC code path."

Still confused? You're not alone.

"David's Web page seems pretty confusing. He tries to say that the servers aren't vulnerable, but at the same time, he says putting in the mitigation (killbit) doesn't break anything," stated Eric Schultze, chief technology officer at Shavlik Technologies, in an e-mail. "I read this and I'm not sure what his real recommendation is."

Schultze said Tuesday's ISA server patch pertained to a scenario involving password breaches provided the ISA Server was configured specifically for Radius One Time password parameters. That issue, after applying Tuesday's patch, is presumably resolved. However, the OWC problem is still up in the air.

"The OWC patch is simply a bad control," Schultze added. "If you're sitting on the ISA Server and you browse to an evil Web page and view an evil Excel workbook (via the OWC control), the attacker can run code on the system. The ISA Server can't be exploited unless someone at the ISA console goes to an evil Web page to view the file in question."

About the Author

Jabulani Leffall is a business consultant and an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. He consulted for Deloitte & Touche LLP and was a business and world affairs commentator on ABC and CNN.

Featured

  • classroom scene with students gathered around a laptop showing a virtual tour interface

    Discovery Education Announces Spring Lineup of Free Virtual Field Trips

    This Spring, Discovery Education is collaborating with partners such as Warner Bros., DC Comics, National Science Foundation, NBA, and more to present a series of free virtual field trips for K-12 students.

  • glowing padlock shape integrated into a network of interconnected neon-blue lines and digital nodes, set against a soft, blurred geometric background

    3 in 4 Administrators Expect a Security Incident to Impact Their School This Year

    In an annual survey from education identity platform Clever, 74% of administrators admitted that they believe a security incident is likely to impact their school system in the coming year. That's up from 71% who said the same last year.

  • horizontal stack of U.S. dollar bills breaking in half

    ED Abruptly Cancels ESSER Funding Extensions

    The Department of Education has moved to close the door on COVID relief funding for schools, declaring that "extending deadlines for COVID-related grants, which are in fact taxpayer funds, years after the COVID pandemic ended is not consistent with the Department’s priorities and thus not a worthwhile exercise of its discretion."

  • pattern of icons for math and reading, including a pi symbol, calculator, and open book

    HMH Launches Personalized Path Solution

    Adaptive learning company HMH has introduced HMH Personalized Path, a K-8 ELA and math product that combines intervention curriculum, adaptive practice, and assessment for students of all achievement levels.