Secunia

Martijn de Vries and Thomas de Klerk have reported a vulnerability in Microsoft ISA Server 2000 and Proxy Server 2.0, which can be exploited by malicious people to spoof Internet content.

The vulnerability is caused due to an error within the method used for caching results of reverse lookups. The problem is that reverse lookups results are used for forward lookups. This can be exploited by making the server perform a reverse lookup for an IP address and then supply a spoofed reverse lookup response for an arbitrary domain name.

Successful exploitation poisons the DNS cache and may result in users unknowingly accessing malicious web sites when attempting to access a trusted web site.

NOTE: Exploitation does not allow spoofing of SSL certificates on HTTPS sites.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Martijn de Vries and Thomas de Klerk

Changelog
Further details available in Customer Area

Original Advisory
MS04-039 (KB888258):
http://www.microsoft.com/technet/security/bulletin/MS04-039.mspx

Deep Links
Links available in Customer Area