HTTP: Microsoft ISA Server 2006 Authentication Bypass

This signature detects attempts to bypass security protections provided by Microsoft Internet Security and Acceleration (ISA) Server 2006, when using Radius One Time Password (OTP) authentication and authentication delegation with Kerberos Constrained Delegation. Using a crafted request, attackers can bypass authentication allowing for privilege escalation. A successful attack can allow an attacker access to otherwise protected files.

Extended Description

Microsoft ISA Server is prone to an authentication-bypass vulnerability. An attacker with knowledge of a valid account name can exploit this issue to bypass authentication and gain access to arbitrary resources within the context of the selected account.

Affected Products

Microsoft isa_server_2006

References

CVE: CVE-2009-1135

URL: http://www.microsoft.com/technet/security/Bulletin/MS09-031.mspx

Short Name

HTTP:ISA-AUTH-BYPASS

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Microsoft ISA Server 2006 Authentication Bypass

Extended Description

Affected Products

References

Found a potential security threat?