PT-2005-2229 · Microsoft · Isa Server 2000

Steve Orrin · Published 2005-06-14 · Updated 2018-10-12 · CVE-2005-1215

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft ISA Server 2000

Description The issue allows remote attackers to poison the cache or bypass content restriction policies. This is achieved by sending a malformed HTTP request packet that contains multiple Content-Length headers.

Recommendations For Microsoft ISA Server 2000, consider restricting access to the server until a fix is available, and review the server's content restriction policies to minimize potential impact. As a temporary workaround, consider implementing additional validation on incoming HTTP request packets to detect and prevent those with multiple Content-Length headers.

Fix

Related Identifiers

CVE-2005-1215

Affected Products

Isa Server 2000

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-1215 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-034 · Vendor Advisory
• http://secunia.com/advisories/15693 · Vendor Advisory
• http://securitytracker.com/id?1014193 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1145 · Note
• http://securityfocus.com/bid/13956 · Note