Signature Detail

HTTP: Microsoft ISA Server 2006 Authentication Bypass

This signature detects attempts to bypass security protections provided by Microsoft Internet Security and Acceleration (ISA) Server 2006, when using Radius One Time Password (OTP) authentication and authentication delegation with Kerberos Constrained Delegation. Using a crafted request, attackers can bypass authentication allowing for privilege escalation. A successful attack can allow an attacker access to otherwise protected files.

Extended Description

Microsoft ISA Server is prone to an authentication-bypass vulnerability. An attacker with knowledge of a valid account name can exploit this issue to bypass authentication and gain access to arbitrary resources within the context of the selected account.

Affected Products

• Microsoft isa_server_2006 SP1
• Microsoft isa_server_2006
• Microsoft isa_server_2006_supportability_update

References

• CVE: CVE-2009-1135
• URL: http://www.microsoft.com/technet/security/Bulletin/MS09-031.mspx