Microsoft foiled in first foray into security

According to Microsoft, the flaw leaves users of version 1.0 of the ISA server - which incorporates a firewall, a virtual private network and a web-cache - vulnerable to denial-of-service attacks, which could cause corresponding web servers to crash.

Canadian e-security specialist Secure-Xpert Labs discovered the bug during testing and Microsoft was informed at the beginning of April.

According to Secure-Xpert, if the web-publishing tool, which is delivered with it, is activated, all that is needed to trigger a crash is a simple character string. ISA is therefore vulnerable even behind its own firewall, with HTML-formatted mails posing a threat.

The ISA server is Microsoft's first software product in the security area and a number of partner companies were involved in the development. No justification has so far been offered for the flaw, but a patch is available at http://microsoft.com/isaserver/support .

By Christian M Wagner, journalist, www.silicon.de