Check Point Advisories

Microsoft ISA Server HTTP Content Header (MS05-034; CVE-2005-1215)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-258
Date Published:	2 Dec 2009
Severity:	High
Last Updated:	Monday 23 December, 2013
Source:
Industry Reference:	CVE-2005-1215
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	The Microsoft Internet Security and Acceleration (ISA) Server is a firewall and web proxy caching server. While relaying client requests to upstream servers, ISA will keep a copy of the returned content in its cache. When unchanged resources are later requested by web clients, the content is served from the cache by ISA to reduce resource consumption and access times. There exists an HTTP protocol handling vulnerability in Microsoft Internet Security and Acceleration (ISA) Server. An attacker can send a malicious HTTP request to a target ISA server to trigger the vulnerability. Successful exploitation may allow the attacker to access restricted content, or cause legitimate users viewing unexpected content from the poisoned web cache. A successful attack exploiting this vulnerability can cause the ISA server and the upstream web entity to be out-of-sync. Affected URLs are cached with content from a different URL. The ISA server will respond to a legitimate request for a web page with the incorrect cached content. Furthermore, the flaw can be exploited to bypass ISA server content restrictions. The attacker can make the ISA server to cache restricted content for a allowed URL, then request the allowed URL to view the restricted content.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.Note that in order for this defense to protect your Microsoft ISA Server, you will need to configure your proxy port to work with the HTTP protocol. For example, if the proxy port is 8080, do the following:1. In the Services tree, click on TCP > HTTP_and_HTTPS_proxy. The TCP Service Properties window opens.2. Click on Advanced. Select the Protocol Type: HTTP.If the proxy works on a different port, you can create a new service with the HTTP protocol type under Services > TCP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Microsoft ISA Server HTTP Content Header (MS05-034) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Proxy Server Enforcement Violation.
Attack Information: Microsoft ISA Server HTTP content header (MS05-034)