Microsoft Patches Spoofing Flaw in ISA Server
Through a flaw in Microsoft's Internet Security and Acceleration Server 2000 and Proxy Server 2.0, users could be served content from malicious sites in lieu of the trusted content they requested.Microsoft has issued a patch for a flaw in ISA (Internet Security and Acceleration) Server 2000 and Proxy Server 2.0. According to the advisory on the bug, it could allow an attacker to spoof trusted Internet content. Microsoft Small Business Server 2000 and 2003, both of which include ISA Server, are also affected. If a user could first be persuaded to visit a particular site, the attack could allow that site to serve that content instead of content from other sites the user believes he is visiting.
The bug would not allow the spoofing of an SSL (Secure Sockets Layer) certificate, and if a spoofed site attempts to use a trusted Web sites SSL certificate, the authentication will fail.