Check Point Advisories

Microsoft ISA Server 2006 Radius OTP Bypass (MS09-031; CVE-2009-1135)

Check Point Reference: CPAI-2009-133
Date Published: 14 Jul 2009
Severity: High
Last Updated: Tuesday 14 July, 2009
Source:
Industry Reference:CVE-2009-1135
Protection Provided by:

Security Gateway
R81, R80, R77, R75, R71, R70, R65
Who is Vulnerable?
Vulnerability Description ISA Server, originating as Microsoft Proxy Server, is a Firewall & Security product that provides Application-Layer Firewalling, acts as a VPN endpoint, and provides Internet Access for client systems in a Business Networking environment. An elevation of privilege vulnerability exists in Microsoft Internet Security and Acceleration (ISA) Server 2006 authentication when configured with Radius One Time Password (OTP). The vulnerability occurs when the ISA Server 2006 attempts to authenticate requests using the HTTP-Basic method. A remote attacker could exploit this vulnerability by sending specially crafted request to the ISA Server. Successful exploitation will allow the attacker to gain access to published resources in the context of a valid user without having to authenticate with the ISA Server.

Protection Overview

This protection will detect and block malformed requests to the ISA Server.Note that in order for this defense to protect your ISA Server, you will need to configure your proxy port to work with the HTTP protocol. For example, if the proxy port is 8080, do the following:1. In the Services tree, click on TCP > HTTP_and_HTTPS_proxy. The TCP Service Properties window opens.2. Click on Advanced. Select the Protocol Type: HTTP.If the proxy works on a different port, you can create a new service with the HTTP protocol type under Services > TCP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75 / R71 / R70 / R65

  1. In the IPS tab, click Protections and find the Microsoft ISA Server 2006 Radius OTP Bypass (MS09-031) protection using the Search tool and Edit the protection's settings.
  2. Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name:  Proxy Server Enforcement Violation.
Attack Information:  Microsoft ISA Server 2006 Radius OTP bypass (MS09-031)

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK