Two vulnerabilities have been reported in Microsoft ISA Server / Forefront Threat Management Gateway MBE, which can be exploited by malicious people to cause a DoS (Denial of Service) or conduct cross-site scripting attacks.

1) An error in the firewall engine when handling the TCP session state for Web proxy and Web publishing listeners can be exploited to cause a Web listener to stop responding to new requests via a specially crafted TCP packet.

2) Input passed to the HTML forms authentication component (cookieauth.dll) is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation of this vulnerability requires that Web publishing is enabled and HTML forms authentication is enabled on the default Web listener.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Reported by the vendor.
2) The vendor credits New York State Chief Information Officer / Office for Technology.

Original Advisory
MS09-016 (KB961759, KB968075, KB960995, KB968078):
http://www.microsoft.com/technet/security/Bulletin/MS09-016.mspx

Deep Links
Links available in Customer Area