Secunia

A vulnerability has been identified in Microsoft ISA Server 2000 allowing malicious HTML documents to conduct Cross Site Scripting against arbitrary sites.

The problem is that the data supplied in the "VIA" header is returned in an error page without being sanitised, when ISA Server fails to connect to the remote host.

By creating a malicious document, which uses the ActiveX Object "Microsoft.XMLHTTP" to conduct a specially crafted request for any other website to a closed port, it is possible to read cookies and more. This is possible to do because JavaScript and other client side scripting injected in the "VIA" header will be executed in the client as if it originated from the requested site.

An exploit has been released.

Solution
Apply patch.
Further details available in Customer Area

Provided and/or discovered by
Hugo Vazquez Carames & Toni Cortes Martinez

Changelog
Further details available in Customer Area

Original Advisory
http://www.microsoft.com/technet/security/bulletin/MS03-028.asp

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area