Microsoft Security Bulletin MS04-039

This is a spoofing vulnerability that exists in the affected products and that could enable an attacker to spoof trusted Internet content. Users could believe they are accessing trusted Internet content when in reality they are accessing malicious Internet content, for example a malicious Web site. However, an attacker would first have to persuade a user to visit the attacker’s site to attempt to exploit this vulnerability.

•	This vulnerability would not allow an attacker to spoof an SSL certificate. An attacker would not be able to successfully use SSL certificates that belong to other domain names. For example, a spoofed Web site cannot use a trusted Web site’s SSL certificate to establish an SSL session with a user. If a spoofed Web site tries to do this, authentication fails and the user receives a warning message.
•	An attacker would first have to persuade a user view content that causes a reverse lookup to occur. For example, an attacker could persuade a user to visit the attacker’s Web site by using an IP address that would cause a reverse lookup to occur.
•	Systems that enable the default Site and Content rule permitting “All traffic” to “All Destinations” are not affected by this vulnerability. However this rule is generally disabled as a security best practice guideline and we do not recommend enabling to help mitigate this issue vulnerability.

Top of section

•

Set the DNS Cache size to zero on the affected software. Setting the DNS Cache size to zero effectively disables DNS caching on the affected system. This would prevent the affected software from using potentially spoofed data from the cache. This may have negative performance impact on DNS resolution. This should only be done on systems that are not able apply the security update as a short term workaround. See Microsoft Knowledge Base Article 889189 for detailed instructions on how to perform this procedure. If you suspect that your system has been effected by attempts to exploit this vulnerability, you can clear the web proxy cache to help remove the suspected malicious content. Microsoft Knowledge Base Article 889189 provides detailed instructions on how to perform this procedure.

Top of section

What is the scope of the vulnerability?
This is a spoofing vulnerability. This vulnerability could enable an attacker to spoof trusted Internet content. Users could believe they are accessing trusted Internet content when in reality they are accessing malicious Internet content, for example a malicious Web site. However, an attacker would first have to persuade a user to visit the attacker’s site to attempt to exploit this vulnerability.

What causes the vulnerability?
The method that the affected software uses to cache reverse lookup results.

What is a reverse lookup?
In DNS, a reverse lookup is a query process by which the IP address of a host computer is searched to find its friendly DNS domain name. For more information about reverse lookup, visit the following Web site.

What is wrong with way that the affected products cache reverse lookup results?
Proxy Server 2.0 and ISA Server 2000 cache the results of a reverse lookup and use that result for a forward (normal) lookup. This approach assumes that the hostname received during the reverse lookup is the valid hostname. The first time a reverse lookup is performed for a particular IP address, an attacker could provide a spoofed reverse lookup response for a domain name that they are not authoritative over. If a user then tries to access the resource by using the domain name that is supplied by the attacker, the user’s request would be routed to the incorrect IP address instead of being serviced by the valid content owner.

What is Proxy Server 2.0?
Proxy Server 2.0 acts as a gateway to the Internet for client computers. A proxy server generally acts as an intermediary between a private network and the Internet. Proxy Server 2.0 also caches Internet content for internal users to increase performance and to reduce outgoing network bandwidth.

What is ISA Server 2000?
ISA Server 2000 provides both an enterprise firewall and a high-performance Web cache. The firewall helps protects the network by regulating which resources can be accessed through the firewall, and under what conditions. The Web cache helps improve network performance by storing local copies of frequently-requested Web content. ISA Server can be installed in three modes: firewall mode, cache mode, or integrated mode.

Firewall mode allows an administrator to secure network communication by configuring rules that control communication between the corporate network and the Internet. Cache mode improves network performance by storing frequently accessed Web pages on the server itself. In integrated mode, all cache and firewall features are available.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could spoof trusted Internet content. Users could believe they are accessing trusted Internet content when in reality they are accessing malicious Internet content such as a malicious Web site. Web sites as well as other types of Internet content could be spoofed if an attacker is successfully able to exploit this vulnerability.

Who could exploit the vulnerability?
Any anonymous user who could display a specially crafted Web page to a client using the ISA Server 2000 or Proxy Server 2.0 system could attempt to exploit this vulnerability.

In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to attempt to exploit this vulnerability. An attacker would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's site. It could also be possible to display malicious Web content using banner advertisements or other ways to deliver Web content to clients of the ISA Server 2000 or Proxy Server 2.0 system.

Even if an attacker is able to display the malicious Web content to a client of the ISA Server 2000 or Proxy Server 2.0 system, the attacker would then have to craft the malicious response to the requesting ISA Server 2000 or Proxy Server 2.0 system to spoof the reverse lookup.

Could the vulnerability be exploited over the Internet?
Yes. An attacker could attempt to exploit this vulnerability over the Internet.

What does the update do?
The update removes the vulnerability by modifying the way that the affected products cache reverse lookup results.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information indicating that this vulnerability had been publicly disclosed when this security bulletin was originally issued.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information indicating that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Top of section

Prerequisites
This security update requires ISA Server Service Pack 1 (SP1), ISA Server 2000 Feature Pack 1, or ISA Server 2000 Service Pack 2 (SP2)

Inclusion in Future Service Packs:
The update for this issue will be included in a future service pack.

Installation Information

This security update supports the following setup switches:

      /help                 Displays the command line options

Setup Modes

      /quiet                Quiet mode (no user interaction or display)

      /passive            Unattended mode (progress bar only)

      /uninstall          Uninstalls the package

Restart Options

      /norestart          Do not restart when installation is complete

      /forcerestart      Restart after installation

Special Options

      /l                        Lists installed Windows hotfixes or update packages

      /o                       Overwrite OEM files without prompting

      /n                       Do not backup files needed for uninstall

      /f                        Force other programs to close when the computer shuts down

      /extract             Extracts files without starting setup

Note You can combine these switches into one command. For backward compatibility, the security update also supports the setup switches that the previous version of the setup utility uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Deployment Information

To install the security update, use the following command at a command prompt for ISA Server 2000:

Isa2000-kb888258-x86-enu.exe

Restart Requirement

This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are in use, this update will require a restart. If this occurs, a message appears that advises you to restart.

Removal Information

To remove this update, use the Add or Remove Programs tool in Control Panel. Select Security Update for Microsoft ISA Server 2000 (KB 888258), and then click Add/Remove. If you installed this update while using ISA Server 2000 Service Pack 1 or ISA Server 2000 Feature Pack 1 you may uninstall this update. If you install this security update while using ISA Server 2000 Service Pack 1 or ISA Server 2000 Feature Pack 1, then install ISA Server 2000 Service Pack 2, and then uninstall this update, you must reinstall ISA Server 2000 Service Pack 2.

File Information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

ISA Server 2000 Service Pack 1, ISA Server Feature Pack 1, ISA Server 2000 Service Pack 2, Small Business Server 2000, Small Business Server 2000 Service Pack 1, Small Business Server 2003:

Date         Time   Version        Size       File name   
----------------------------------------------------------
28-Oct-2004  00:32  3.0.1200.408   110,072    Msphlpr.dll

Verifying Update Installation

Prerequisites
This security update requires the release version of Proxy Server 2.0 Service Pack 1.

Deployment Information

To install the security update, use the following command at a command prompt:

Proxy20-KB888258-x86-enu.exe

Restart Requirement

You must restart your system after you apply this security update.

Removal Information

You can remove the Proxy Server 2.0 Service Pack 1 security update by using the Add/Remove Programs tool in the Control Panel. Select Proxy Server 2.0 Hotfix - KB888258, and then click Add/Remove.

File Information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Proxy Server 2.0:

Date         Time   Version     Size     File name
-----------------------------------------------------
28-Oct-2004  01:18  2.0.390.16   43,280  W3pcache.dll
28-Oct-2004  01:26  2.0.390.16  192,784  W3proxy.dll
28-Oct-2004  01:18  2.0.390.16   97,040  Wspsrv.exe

Note The file versions of these files are the same as the Proxy Server 2.0 Server Pack 1 files. You cannot use the files version information to verify successful installation.

Verifying Update Installation