- Overview
>From the vendor:
"ISA Server provides transparent support for client computers that have 
no special client software installed, running on any platform or 
operating system, using SecureNAT."

- Description:
There is an access violation error in Microsoft Internet Security and 
Acceleration (ISA) Server's Firewall service's executable file. This 
problem may occur if heavy network traffic from client computers is 
handled by the Firewall service; Wspsrv.exe. It is needed that client 
computers are configured as SecureNAT clients. Finally the Microsoft ISA 
Firewall service may unexpectedly crash and quit.
Versions ISA Server 2000 and ISA Server 2000 Service Pack 2 (SP2) are 
affected (both versions ISA Server Standard Edition; SSE, and ISA Server 
Enterprise Edition; EE, are released).

This can cause a false sense of security and unexpected conditions. 
Server administrator operations is needed to return an ISA server to a 
normal state and Firewall service to work again.
It is possible that the network's protection is not fully working when 
the Microsoft ISA Firewall service is ended.

This can be possibly exploited by a malicuous user in an internal 
network by generating heavy network traffic from his/hers workstation.

NOTE: This issue can be caused if a new server is published behind ISA 
Server 2000 too and later heavy network traffic is generated.

Wspsrv.exe versions prior than 3.0.1200.411 are affected.

Affected component: Wspsrv.exe (ISA Firewall service .exe file)

- Solution:
A hotfix can be obtained by contacting Microsoft Product Support Services:
http://support.microsoft.com/contactus/?ws=support

Users having problems mentioned are urged to contact the vendor for 
information on obtaining an updated file.
NOTE: ISA Server 2000 Service Pack 2 installed is needed to apply this hotfix.

If this is not possible immediately, the following workarounds are 
provided by the reporter:

- Workarounds:
Restrict access from the clients by setting limitations to network 
traffic amount.
Confirm that client computers are configured to use Windows Firewall or 
Internet Connection Firewall (ICF).

- References:
Microsoft Support / Knowledbe Base Article #894864:
"The ISA Firewall service may unexpectedly quit when ISA Server 2000 
experiences heavy network traffic"
http://support.microsoft.com/kb/894864/EN-US/

Microsoft TechNet ISA Server Home Page:
"Microsoft Internet Security and Acceleration (ISA) Server"
http://www.microsoft.com/technet/prodtechnol/isa/default.mspx

Microsoft TechNet:
"Microsoft Internet Security and Acceleration Server 2000 (ISA) 
Technical Overview / Firewall Protection for Secure Internetworking"
http://www.microsoft.com/technet/prodtechnol/isa/2000/evaluate/isatecov.mspx#EHAA

"Microsoft ISA Server 2000, Standard Edition - Installation and 
Deployment Guide"
Chapter 2: Planning Considerations / Assessing Client Requirements
http://www.microsoft.com/technet/prodtechnol/isa/2000/deploy/isastnin.mspx#EGAA

Software: Microsoft ISA Server 2000,
Microsoft ISA Server 2000 SP2

OS: Windows

- Solution status:
Vendor patch

Vendor:
Microsoft Corporation

Vendor homepage:
http://www.microsoft.com/isaserver/

This information was announced by the vendor, and analyzed, collected 
and written to a report by me.


Best regards,
Juha-Matti Laurio, Networksecurity.fi
IT security researcher
<juha-matti.laurio [at] netti.fi>
http://www.networksecurity.fi/
Finland