PT-2007-1306 · Microsoft · Internet Security/Acceleration (Isa) Server 2004

Published 2007-02-23 · Updated 2018-10-16 · CVE-2006-7027

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Security and Acceleration (ISA) Server 2004

Description The issue allows remote attackers to manipulate portions of the log file by including unusual ASCII characters, such as the tab, in the Host header. This could potentially be leveraged for other attacks.

Recommendations For Microsoft Internet Security and Acceleration (ISA) Server 2004, consider restricting or sanitizing the input allowed in the Host header to prevent the inclusion of unusual ASCII characters, such as the tab, until a more comprehensive fix is available.

Fix

Related Identifiers

CVE-2006-7027

Affected Products

Internet Security/Acceleration (Isa) Server 2004

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-7027 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26233 · Note
• http://securityfocus.com/archive/1/433074/30/5190/threaded · Note
• http://securityfocus.com/archive/1/432947/30/5190/threaded · Note
• http://securityfocus.com/archive/1/433141/30/5160/threaded · Note
• http://securityfocus.com/archive/1/433350/30/5100/threaded · Note