PT-2007-6101 · Microsoft · Internet Security/Acceleration (Isa) Server

Published 2007-09-21 · Updated 2017-07-29 · CVE-2007-4991

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Security and Acceleration (ISA) Server 2004 versions SP1 through SP2

Description The issue allows remote attackers to obtain potentially sensitive information, specifically the destination IP address of another user's session, by sending an empty packet to the SOCKS4 Proxy.

Recommendations For Microsoft Internet Security and Acceleration (ISA) Server 2004 versions SP1 and SP2, consider restricting access to the SOCKS4 Proxy until a fix is available. As a temporary workaround, limiting the information exposed by the proxy or implementing additional logging and monitoring may help minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-4991

Affected Products

Internet Security/Acceleration (Isa) Server

References · 6

• http://securityfocus.com/bid/25753 · Patch
• http://zerodayinitiative.com/advisories/ZDI-07-053.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4991 · Security Note
• http://osvdb.org/45906 · Note
• http://securitytracker.com/id?1018727 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36715 · Note