Signature Detail

HTTP: ISA Server Cross Site Scripting

This signature detects attempts to exploit a known vulnerability against Microsoft ISA server authentication mechanism. A successful attack can lead to cross-site scripting against the client browser connecting to the ISA server. This could lead to credential stealing.

Extended Description

Microsoft ISA (Internet Security and Acceleration) Server and Forefront Threat Management Gateway (TMG) are prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

Affected Products

• Microsoft Forefront Threat Management Gateway Medium Business Edition
• Microsoft ISA Server 2006 SP1
• Microsoft ISA Server 2006
• Microsoft ISA Server 2006 Supportability Update

References

• CVE: CVE-2009-0237
• URL: http://www.microsoft.com/technet/security/Bulletin/MS09-016.mspx