CVE-2009-1135: Critical severity microsoft internet security and acceleration server vulnerability
Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to a network resource behind the ISA Server, aka "Radius OTP Bypass Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1135?
CVE-2009-1135 is considered a critical vulnerability due to its potential to allow unauthorized access to sensitive web pages.
How do I fix CVE-2009-1135?
To mitigate CVE-2009-1135, it is recommended to disable HTTP-Basic authentication and implement more secure authentication methods.
Which software is affected by CVE-2009-1135?
CVE-2009-1135 affects Microsoft Internet Security and Acceleration (ISA) Server 2006, including its SP1 and supportability versions.
Can CVE-2009-1135 lead to credential theft?
Yes, CVE-2009-1135 can lead to credential theft as attackers can exploit the vulnerability to gain privileges of arbitrary accounts.
Is there a workaround for CVE-2009-1135?
A possible workaround for CVE-2009-1135 is to restrict access to the ISA Server from untrusted networks while awaiting a patch.