Preemptive Protection against Microsoft ISA Server Cross-Site Scripting (XSS) Vulnerability (MS09-016)

Vulnerability
Protection

Check Point Reference:	CPAI-2009-092
Date Published:
Severity:
Last Updated:
Source:	Microsoft Security Bulletin MS09-016
Industry Reference(s):	CVE-2009-0237
Protection Provided by:	Security Gateway R70 VPN-1 NGX R65 NGX R62 NGX R61 NGX R60 VSX NGX R65 InterSpect NGX IPS-1 IPS-1 IPS-1 NGX R65
Who is Vulnerable? Microsoft Forefront Threat Management Gateway, Medium Business Edition Microsoft Internet Security and Acceleration (ISA) Server 2006 Enterprise Edition Microsoft Internet Security and Acceleration (ISA) Server 2006 Enterprise Edition SP1 Microsoft Internet Security and Acceleration (ISA) Server 2006 Enterprise Edition Supportability Update Microsoft Internet Security and Acceleration (ISA) Server 2006 Standard Edition Microsoft Internet Security and Acceleration (ISA) Server 2006 Standard Edition SP1 Microsoft Internet Security and Acceleration (ISA) Server 2006 Standard Edition Supportability Update
Vulnerability Description A cross-site scripting (XSS) vulnerability has been reported in the cookieauth.dll component in Microsoft Internet Security and Acceleration (ISA) Server. ISA Server, originating as Microsoft Proxy Server, is a Firewall & Security product that provides Application-Layer Firewalling, acts as a VPN endpoint, and provides Internet Access for client systems in a Business Networking environment. A remote attacker may exploit this vulnerability to run malicious scripts on an affected system.

Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS09-016

Vulnerability Details
The vulnerability is due to an input validation error in the HTTP stream. A remote attacker can exploit this issue to execute a cross-site scripting attack through the cookieauth.dll component in ISA Server or Forefront TMG, by convincing a user to click on a maliciously crafted URL that contains a script code. Successful exploitation of this vulnerability could allow the attacker to inject script code into the web pages viewed by other users.

Protection Overview
This protection will detect and block Cross-Site Scripting attacks. No update is required to address this vulnerability for users of Security Gateway R70, VPN-1 NGX R61, R62 and R65, VSX NGX R65 and InterSpect NGX. Users of IPS-1 need to update their systems. IPS-1 will detect and block attempts to inject JavaScript into known-vulnerable HTTP APIs.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Web Intelligence > Application Layer.
2. In the right pane, double-click the Cross-Site Scripting protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. The protection can be applied either to all HTTP traffic or to selected web servers.

- If you choose to apply the protection to all HTTP traffic, change the security level to HIGH.

- If you choose to apply the protection to selected web servers:
I. Next to "Apply to selected web servers" click Customize.
II. Choose the relevant web server and click Configure Default....
III. Change the Security Level to HIGH and click OK.

5. Install policy on all modules.