Detections
Analytics
MS09-016: Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway Could Cause Denial of Service (961759)
medium Nessus Plugin ID 36154
Language:
Synopsis
The remote host contains an application that is affected by multiple vulnerabilities.Description
The version of Microsoft ISA Server or Forefront Threat Management Gateway installed on the remote host is affected by one or both of the following vulnerabilities :- By sending a series of specially crafted packets, an anonymous remote attacker can create orphaned open sessions in the firewall engine, thereby denying service to legitimate users. (CVE-2009-0077)
- A non-persistent cross-site scripting vulnerability exists in the application due to its failure to sanitize input to its 'cookieauth.dll' script. (CVE-2009-0237)
Solution
Microsoft has released a set of patches for ISA Server 2004 and 2006 as well as Forefront Threat Management Gateway.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-016
Plugin Details
Severity: Medium
ID: 36154
File Name: smb_nt_ms09-016.nasl
Version: 1.24
Type: local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 4/14/2009
Updated: 1/26/2022
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.4
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
Vulnerability Information
CPE: cpe:/a:microsoft:isa_server, cpe:/a:microsoft:forefront_threat_management_gateway
Required KB Items: SMB/MS_Bulletin_Checks/Possible
Exploit Ease: No known exploits are available
Patch Publication Date: 4/14/2009
Vulnerability Publication Date: 4/14/2009
Reference Information
CVE: CVE-2009-0077, CVE-2009-0237